Oracle Global Order Promising EUVD-2026-106239

Exploitation requires: (1) a valid low-privilege Oracle E-Business Suite account (PR:L - this is authenticated access, not a bypass); (2) network HTTP reachability to the Global Order Promising Web Service component on an affected EBS instance running version 12.2.3 through 12.2.15; and (3) satisfaction of conditions reflected by High attack complexity (AC:H), such as winning a race condition or specific server-side state the attacker cannot directly control. No end-user interaction is needed (UI:N). The chief limiting factors are the mandatory authenticated account and the High complexity, which together make reliable, repeatable exploitation difficult; the scope change (S:C) is an aggravating factor, as successful attacks can affect additional products beyond the vulnerable module.

This is a legitimately serious but not top-tier-urgent vulnerability. The CVSS 3.1 score of 8.2 is driven by network attack vector (AV:N over HTTP), high confidentiality and integrity impact (C:H/I:H), and critically a scope change (S:C) meaning exploitation can impact products beyond Global Order Promising itself. However, two signals temper the real-world urgency: attack complexity is High (AC:H), indicating the attacker must win a race condition or satisfy conditions outside their control, and Privileges Required is Low (PR:L), meaning the attacker needs an existing authenticated low-privilege EBS account rather than being fully unauthenticated. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so exploitation probability signals are absent - this is no public exploit identified at time of analysis. The combination of AC:H plus PR:L substantially raises the bar versus a pre-auth, low-complexity flaw, so despite the High CVSS this should be prioritized as an important patch (especially where untrusted users hold EBS accounts) rather than treated as an actively-exploited emergency. Note the input 'Authentication Bypass' tag conflicts with the CVSS PR:L (authentication required) - this appears to be a mislabel and should not be read as pre-authentication access.

An attacker who already holds a low-privilege Oracle E-Business Suite account sends crafted HTTP requests to the Global Order Promising Web Service, exploiting a flaw that under the right (hard-to-control) conditions lets them read and alter critical data. Because of the scope change, the impact can extend to additional Oracle products beyond Global Order Promising. No public exploit code is known at the time of analysis, and the High attack complexity means exploitation is not reliably repeatable.