Oracle E-Business Suite EUVD-2026-37250

Requires (1) network reachability to the Oracle E-Business Suite HTTP/HTTPS front-end exposing the Complex Maintenance, Repair and Overhaul module, (2) valid low-privileged EBS credentials with at least a responsibility that can reach the Internal Operations component (PR:L in the CVSS vector), and (3) an affected deployment running CMRO on EBS 12.2.3 through 12.2.15. Exploitation is rated AC:H by Oracle, meaning the attacker must satisfy additional non-trivial conditions beyond simply sending a request - for example specific configuration state, timing, or knowledge of internal identifiers - which limits opportunistic abuse. No user interaction is required (UI:N), and scope is unchanged (S:U), so impact is confined to the CMRO/EBS application itself rather than the underlying OS.

The signals are mixed and lean toward a moderate, not urgent, priority. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) yields 7.5 - full CIA impact and takeover are serious, but AC:H (specific conditions or non-trivial work needed) and PR:L (an authenticated EBS user is required) materially reduce the realistic attacker pool. No EPSS score, KEV listing, or public POC was provided, so there is no evidence of active exploitation or commodity exploit code. CWE is N/A and no third-party analysis is referenced, so the precise bug class is not independently confirmed. Prioritize behind any unauthenticated EBS CPU items in the same advisory, but do not defer indefinitely: takeover of CMRO can pivot into the broader EBS database via shared schemas.

An attacker who has obtained any low-privileged EBS account - for example through a phished maintenance technician or a contractor login - logs in over HTTPS and issues crafted requests against a CMRO Internal Operations endpoint, navigating the high-complexity preconditions until the flaw triggers and yields full control of the CMRO module's data and functions. From there the attacker can alter maintenance records, exfiltrate sensitive operational data, and potentially pivot to other EBS schemas sharing the APPS database account. No public exploit identified at time of analysis, so any campaign would require original research against the patched binaries.