What is the CVSS score of EUVD-2026-37250?

EUVD-2026-37250 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by EUVD-2026-37250?

Oracle E-Business Suite versions 12.2.3 through 12.2.15 contain a critical vulnerability in the Complex Maintenance, Repair and Overhaul (CMRO) module that allows any low-privilege authenticated…

How to fix or mitigate EUVD-2026-37250?

Within 24 hours: Inventory all Oracle EBS installations running versions 12.2.3-12.2.15 and map CMRO module usage. Restrict HTTP network access to CMRO to a minimal set of authorized administrators. Within 7 days: Implement application-level access controls limiting CMRO functionality to essential personnel only; notify users of the vulnerability and restricted access. Within 30 days: Upgrade affected Oracle EBS instances to version 12.2.16 or later, or implement network segmentation and enhanced monitoring as interim controls pending patch availability.

Oracle E-Business Suite EUVD-2026-37250

| CVE-2026-46934 HIGH

Improper Privilege Management (CWE-269)

2026-06-16 oracle

Oracle Oracle Complex Maintenance Repair And Overhaul Privilege Escalation

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

HTTP-reachable EBS module needing a valid low-privileged account (PR:L) and non-trivial preconditions (AC:H); full takeover of CMRO yields C:H/I:H/A:H within the same security scope.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:03 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Complex Maintenance, Repair and Overhaul. Successful attacks of this vulnerability can result in takeover of Oracle Complex Maintenance, Repair and Overhaul. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Takeover of Oracle Complex Maintenance, Repair and Overhaul (CMRO) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker with HTTP network access to fully compromise the Internal Operations component. Oracle's June 2026 Critical Patch Update advisory documents the issue with a CVSS 3.1 base score of 7.5 and high confidentiality, integrity, and availability impact. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain low-privileged EBS account

Delivery

Reach CMRO HTTP endpoint

Exploit

Satisfy high-complexity preconditions

Execution

Exploit Internal Operations flaw

Persist

Take over CMRO module

Impact

Tamper with maintenance data and exfiltrate

Access

Obtain low-privileged EBS account

Delivery

Reach CMRO HTTP endpoint

Exploit

Satisfy high-complexity preconditions

Execution

Exploit Internal Operations flaw

Persist

Take over CMRO module

Impact

Tamper with maintenance data and exfiltrate

Vulnerability AssessmentAI

Exploitation	Requires (1) network reachability to the Oracle E-Business Suite HTTP/HTTPS front-end exposing the Complex Maintenance, Repair and Overhaul module, (2) valid low-privileged EBS credentials with at least a responsibility that can reach the Internal Operations component (PR:L in the CVSS vector), and (3) an affected deployment running CMRO on EBS 12.2.3 through 12.2.15. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals are mixed and lean toward a moderate, not urgent, priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who has obtained any low-privileged EBS account - for example through a phished maintenance technician or a contractor login - logs in over HTTPS and issues crafted requests against a CMRO Internal Operations endpoint, navigating the high-complexity preconditions until the flaw triggers and yields full control of the CMRO module's data and functions. From there the attacker can alter maintenance records, exfiltrate sensitive operational data, and potentially pivot to other EBS schemas sharing the APPS database account. …
Remediation	Apply the fixes from Patch available per vendor advisory: Oracle Critical Patch Update Advisory of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html), which covers CMRO on EBS 12.2.3-12.2.15; Oracle typically ships these as EBS 12.2 consolidated patches via My Oracle Support, so apply the relevant CMRO/Internal Operations patch and any prerequisite AD/TXK updates in a test environment first. … Detailed patch versions, workarounds, and compensating controls in full report.