Oracle General Ledger EUVD-2026-106399

Exploitation requires an authenticated low-privileged account on Oracle E-Business Suite (PR:L) with network/HTTP access to the General Ledger product's Internal Operations component, affecting supported versions 12.2.3 through 12.2.15. The defining limiting factor is the HIGH attack complexity (AC:H): the attacker must meet specialized conditions beyond their control (e.g., specific state or timing within Internal Operations), so this is not reliably repeatable against default deployments. No end-user interaction is needed (UI:N). The authentication requirement and high complexity are the primary factors that constrain real-world exploitation despite the network vector.

This is a genuine but second-tier priority rather than an emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H, base 7.1) describes a network-reachable flaw requiring low-privilege authentication (PR:L) and carrying HIGH attack complexity (AC:H), meaning exploitation depends on conditions outside the attacker's control and is not a simple drive-by. Impact is weighted toward integrity and availability (I:H/A:H) with only limited confidentiality exposure (C:L), consistent with the description's emphasis on unauthorized data creation/deletion/modification and a complete DOS of Oracle General Ledger. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of AC:H plus required authentication materially lowers real-world risk relative to the 7.1 headline score; however, because this is an Oracle Critical Patch Update item affecting a financial ERP system holding sensitive accounting data, it warrants prompt patching through the normal CPU cycle. No conflicting signals were detected in the provided data, but note that EPSS and exploit-maturity data are simply absent, not confirmed negative.

A low-privileged but authenticated user of the Oracle E-Business Suite General Ledger module sends crafted HTTP requests to the Internal Operations component to abuse the flaw. Because attack complexity is high, the attacker must satisfy specific timing or environmental conditions, after which they can tamper with or destroy critical ledger data and trigger a complete, repeatable crash (DOS) of General Ledger. No public exploit code is identified at time of analysis.