EUVD-2026-24349
GHSA-26v3-j7q3-5cqg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-accessible UI with no attacker privileges; victim interaction required; scope change to other EBS modules; no availability impact confirmed.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Configurator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Configurator accessible data as well as unauthorized read access to a subset of Oracle Configurator accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
AnalysisAI
Cross-site scripting or improper access control in Oracle Configurator's User Interface component allows unauthenticated remote attackers to compromise data confidentiality and integrity across Oracle E-Business Suite. Affected versions span the full supported range of 12.2.3 through 12.2.15, requiring an authenticated victim to interact with attacker-controlled content to trigger the flaw. The scope change (S:C) signals that exploitation can pivot beyond Oracle Configurator itself into adjacent E-Business Suite products; no public exploit code has been identified and SSVC confirms exploitation status as none at time of analysis.
Technical ContextAI
Oracle Configurator is the product configuration and rules engine embedded in Oracle E-Business Suite (EBS), used to manage complex product structures and ordering logic. The affected component is the User Interface layer, which handles HTTP-based interactions. CWE-284 (Improper Access Control) covers failure to restrict access to resources or functionality - in the context of a network-accessible UI with scope change and user-interaction-required (S:C, UI:R in the CVSS vector), this is consistent with a client-side injection flaw such as reflected or stored XSS, where insufficient input/output controls allow attacker-supplied content to execute in a victim's browser session across the EBS application boundary. The CPE string cpe:2.3:a:oracle_corporation:oracle_configurator:*:*:*:*:*:*:*:* with the version range 12.2.3-12.2.15 covers the complete currently supported EBS 12.2 line.
RemediationAI
Apply the patches released in the Oracle Critical Patch Update (CPU) for April 2026, available via Oracle Support and documented at https://www.oracle.com/security-alerts/cpuapr2026.html. Oracle CPUs deliver cumulative patches per EBS version; customers on 12.2.3-12.2.15 should apply the appropriate patch set referenced in the CPU advisory. Exact patched version identifiers are not independently confirmed from available data beyond the CPU advisory itself. As a compensating control prior to patching, restrict access to Oracle Configurator's User Interface endpoints to trusted internal networks or VPN users only, which reduces the network-accessible attack surface - note this does not eliminate risk for insider or VPN-connected threat actors. Additionally, enforce strict Content Security Policy (CSP) headers if supported by the EBS web tier configuration to limit the impact of any client-side injection. Monitoring EBS application logs for anomalous form submissions or unexpected redirects targeting Configurator UI endpoints can serve as a detection layer.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today