EUVD-2026-24385
GHSA-jpw8-46mw-jgq7
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Network vector via HTTP confirmed; high privileges required per description; partial CIA impacts and unchanged scope align with bounded Personalization component access.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 12.2.9-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data as well as unauthorized read access to a subset of Oracle Applications Framework accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Applications Framework. CVSS 3.1 Base Score 4.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).
AnalysisAI
Oracle Applications Framework's Personalization component in E-Business Suite versions 12.2.9 through 12.2.15 allows an authenticated, high-privileged attacker to exceed intended authorization boundaries via HTTP, resulting in unauthorized data read, write, and partial denial of service against the framework. Root cause is CWE-284 (Improper Access Control), confirmed by Oracle's April 2026 Critical Patch Update. No public exploit code exists and EPSS sits at 0.03% (10th percentile), aligning with SSVC's 'Exploitation: none' assessment - this is a low-urgency, medium-severity finding gated entirely by the requirement for pre-existing high-privilege access.
Technical ContextAI
Oracle Applications Framework (OAF) is the Java/JSP-based development and runtime platform underlying Oracle E-Business Suite (EBS), one of the largest enterprise ERP stacks in production. The Personalization component allows administrators and privileged users to customize EBS module layouts, logic, and data presentation. CPE cpe:2.3:a:oracle_corporation:oracle_applications_framework:*:*:*:*:*:*:*:* confirms the affected product across version range 12.2.9 to 12.2.15. The root cause class, CWE-284 (Improper Access Control), indicates that the Personalization subsystem fails to properly enforce authorization boundaries - a privileged user can access or manipulate framework-managed data or operations beyond what their role should permit. This is a logic-level authorization flaw, not a memory corruption or injection class issue.
RemediationAI
Apply the Oracle Critical Patch Update (CPU) for April 2026, available at https://www.oracle.com/security-alerts/cpuapr2026.html. Oracle's CPU is the authoritative source for patch details, including any specific upgraded version or patch number for E-Business Suite. An exact fixed version string beyond 'addressed in the April 2026 CPU' is not available in the current data set - consult the advisory directly to identify the applicable patch. As a compensating control prior to patching, organizations should audit and restrict who holds high-privilege roles within the Personalization component, applying least-privilege principles to limit the population capable of triggering this flaw. Restricting network access to EBS administrative interfaces via firewall or VPN where feasible reduces exposure further, though neither compensating control eliminates the underlying improper access control defect.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today