Oracle Configure to Order EUVD-2026-37254

Attacker must have network HTTP/HTTPS reachability to an Oracle E-Business Suite 12.2.3-12.2.15 instance that has the Oracle Configure to Order module deployed with the Supply to Order Workbench component active, and must hold a low-privileged authenticated EBS session (PR:L per Oracle's CVSS vector), but no user interaction, no elevated role, and no scope change are required. Exploitation is limited to environments where Configure to Order is actually licensed and provisioned and where the EBS web tier is reachable by the attacker; internet-exposed EBS portals and self-service / iSupplier deployments materially expand the realistic attacker population, while CtO modules that are licensed but not enabled, or strictly internal EBS deployments behind VPN, narrow it.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) describes a network-reachable, low-complexity attack requiring only a low-privileged EBS account and no user interaction, with high confidentiality and integrity impact but no availability impact - a strong signal for prioritization wherever EBS self-service or vendor/customer portal accounts exist. There is no EPSS score, SSVC decision, or CISA KEV entry provided, and no POC was identified, so probability of mass exploitation cannot be quantified from the input; however, Oracle's own 'easily exploitable' language and the 'Authentication Bypass' tag conflict with the PR:L metric and warrant verifying with Oracle whether the real prerequisite is any authenticated session or a specific role. Given EBS's role as a system of record for financial and supply-chain data and Oracle CPU vulnerabilities' historical pattern of post-disclosure exploitation, this should be treated as a real near-term priority, not a paper high.

An attacker who has obtained any low-privileged Oracle E-Business Suite account - for example through phishing of an internal user, reuse of a leaked supplier-portal credential, or a self-registered account on an exposed instance - authenticates to the EBS HTTP front end and issues crafted requests against the Supply to Order Workbench. Because the flaw is network-reachable with low attack complexity and no user interaction, a single HTTP transaction can read or alter supply-order data well outside the attacker's intended scope, enabling fraud such as redirecting supply against orders or exfiltrating sensitive customer and pricing data. No public exploit identified at time of analysis.