Oracle E-Business Suite EUVD-2026-33042

The Internet Procurement Connector component of Oracle E-Business Suite 12.2.3-12.2.15 must be deployed and reachable by the attacker over HTTP - this is the default for any EBS installation that uses procurement integrations with external suppliers. No authentication, no privileges, no user interaction, and no special non-default configuration are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N) and Oracle's 'Easily exploitable' classification. Practical limits on exploitation: the EBS web tier hosting the connector must be network-reachable by the attacker (many enterprises front EBS with VPN or restrict it to internal networks, which is the single most important limiting factor), the target instance must be in the supported 12.2.3-12.2.15 range, and exploitation is confined to data accessible via the connector - no availability impact (A:N) and no scope change (S:U), so the attacker cannot directly pivot to other EBS modules or the underlying host through this CVE alone.

Multiple signals converge to make this a top-tier priority for affected operators. The CVSS 9.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst practical case short of full compromise: remote, internet-reachable, no auth, no user interaction, low complexity - Oracle's own 'Easily exploitable' language reinforces this. The lack of an availability impact (A:N) suggests the bug is a data-access/integrity flaw rather than a memory corruption, which typically makes weaponization simpler and more reliable. No EPSS score, KEV listing, or public POC was provided in the input - so realistic exploitation likelihood cannot yet be quantified, but Oracle EBS has been heavily targeted historically (the 2023 Cl0p MOVEit campaign and the 2025 EBS zero-day campaigns) and ransomware affiliates monitor Oracle CPU advisories closely. Treat the absence of a KEV entry as a temporary state, not a safety signal; the 12.2.3-12.2.15 range covers virtually every supported 12.2 deployment, so the addressable target surface is large.

An external attacker scans for internet-facing Oracle EBS 12.2 deployments (often identifiable by /OA_HTML/ paths and Oracle banners), sends crafted HTTP requests directly to Internet Procurement Connector endpoints without authenticating, and uses the resulting access to exfiltrate supplier, contract, and financial data and/or inject fraudulent procurement records to enable invoice fraud. Because the CVSS vector specifies AV:N/AC:L/PR:N/UI:N, the attack is a single-shot HTTP request and trivially automatable once endpoint details are known - no public exploit identified at time of analysis, but the simplicity of the bug class means a POC is likely to surface quickly after the May 2026 CPU advisory is dissected.