Oracle E-Business Suite EUVD-2026-37251

The attacker must (1) have network reachability to the Oracle E-Business Suite application tier over HTTP/HTTPS - typically internal LAN, VPN, or an exposed EBS portal - and (2) possess valid credentials for an EBS account with at least low privileges, per PR:L in the CVSS vector. The target must be running Oracle Complex Maintenance, Repair and Overhaul on EBS 12.2.3 through 12.2.15 with the Internal Operations component active. Exploitation is further limited by AC:H, indicating the attack depends on conditions beyond the attacker's control - likely specific CMRO configuration, data state, or a race/timing element - which materially reduces the chance of opportunistic mass exploitation against default deployments.

The CVSS 3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high impact tempered by AC:H (non-trivial exploitation conditions, e.g. timing, configuration, or chained steps) and PR:L (a valid EBS user account is required). No EPSS score, KEV listing, or public PoC was provided in the source data, and the only reference is Oracle's quarterly Critical Patch Update advisory, which historically does not include technical detail. Real-world risk is moderate rather than urgent: EBS deployments are typically internal or VPN-gated, so the attacker population is largely insiders or anyone who has phished a low-privilege EBS account, but the 'takeover' impact on a CMRO module that often touches safety-critical maintenance records makes this a priority patch for affected operators. Note that Oracle's advisory text and the CVSS vector both indicate network/HTTP access, so there is no contradiction to flag.

An attacker who has obtained or been issued a low-privilege Oracle EBS account (for example a contractor, a phished maintenance technician, or a compromised vendor login) reaches the CMRO Internal Operations endpoints over HTTP and submits a crafted request sequence that abuses the vulnerable logic to escalate within the module. Because Oracle classifies the result as 'takeover' of CMRO, the attacker can then read, modify, or destroy maintenance work orders, parts records, and operational data tied to high-value assets. No public exploit identified at time of analysis, and AC:H means a working exploit likely requires non-trivial reverse engineering of the CMRO module.