Oracle E-Business Suite EUVD-2026-106407

Exploitation requires the attacker to already possess HIGH application privileges within Oracle E-Business Suite (PR:H) and network HTTP access to the Oracle Applications Framework Web Utilities component on affected versions 12.2.3 through 12.2.15. No user interaction is needed and attack complexity is low once those privileges are held, but the high-privilege requirement is the dominant limiting factor - this restricts realistic exploitation to trusted/privileged insiders or attackers who have already compromised a privileged EBS account, substantially narrowing the threat population despite the network attack vector.

This is a moderate-severity, high-prerequisite issue rather than a top-tier emergency. The CVSS 3.1 base score is 4.9 (MEDIUM) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N: network-reachable over HTTP with low attack complexity and no user interaction, but it explicitly requires a HIGH-privileged attacker (PR:H), which sharply limits who can exploit it. Impact is confined to confidentiality (C:H, with I:N/A:N), so the worst case is disclosure of Oracle Applications Framework-accessible data, not integrity or availability damage. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so there is no public signal of active exploitation or weaponization - no public exploit identified at time of analysis. One notable conflict: the input Tags include 'Authentication Bypass,' which directly contradicts the CVSS PR:H metric (an authentication bypass would imply low/no privilege, i.e. PR:N) - verify the tag with the vendor, as it appears mislabeled and the authoritative Oracle CVSS vector should be trusted over the tag. Net: a privileged-insider / compromised-account confidentiality risk, worth patching in normal Oracle CPU cadence but not a drop-everything network-exploitable unauthenticated flaw.

An attacker who already holds a high-privileged Oracle E-Business Suite account (or has hijacked one) sends crafted HTTP requests to the Web Utilities component of Oracle Applications Framework and reads critical data they should not be able to access. No user interaction is required and attack complexity is low, but the high-privilege prerequisite means this is realistically an insider or post-compromise escalation-of-access scenario; no public exploit code was identified in the provided data.