What is the CVSS score of EUVD-2026-37263?

EUVD-2026-37263 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by EUVD-2026-37263?

Oracle E-Business Suite Quality module (versions 12.2.3-12.2.15) contains a vulnerability allowing any low-privilege user to take over accounts and fully compromise the module, exposing sensitive…

How to fix or mitigate EUVD-2026-37263?

Within 24 hours: Identify all Oracle E-Business Suite deployments running versions 12.2.3-12.2.15 with the Quality module enabled; assess which systems are accessible from untrusted networks. Within 7 days: Deploy network-level access controls (firewall rules, WAF, or network segmentation) to restrict HTTP access to Quality module functions; enable comprehensive monitoring and alerting on user account activity and authentication attempts within the module. Within 30 days: Contact Oracle support to confirm patch availability and timeline; evaluate upgrade paths to versions 12.2.16 or later; implement additional application-layer access controls such as IP whitelisting or multifactor authentication for Quality module access; conduct a user access review to minimize low-privilege accounts with Quality module permissions.

Oracle E-Business Suite EUVD-2026-37263

| CVE-2026-46951 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Quality Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

HTTP-reachable EBS component, vendor labels exploitation easy with no user interaction, requires a low-privileged EBS account, and results in full Quality module takeover (C/I/A High).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:56 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Quality. Successful attacks of this vulnerability can result in takeover of Oracle Quality. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover of the Oracle Quality module in Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker to fully compromise the component over HTTP. Per the vendor's June 2026 Critical Patch Update advisory the issue is rated CVSS 8.8 with high impact on confidentiality, integrity, and availability, and no public exploit identified at time of analysis. Risk is elevated for internet- or intranet-exposed EBS deployments because exploitation is rated 'easily exploitable' and only requires a valid low-privilege session.

Technical ContextAI

Oracle Quality is a manufacturing quality-management module of the Oracle E-Business Suite (EBS) 12.2 family, and the affected component is identified as Internal Operations - typically a set of authenticated HTTP-accessible business functions served by Oracle HTTP Server / WebLogic in front of the EBS application tier. The CPE 'cpe:2.3:a:oracle_corporation:oracle_quality' confirms the Oracle Quality product surface, and the entire EBS 12.2.x maintenance line (12.2.3 through 12.2.15) is in scope. No CWE was assigned by Oracle, which is consistent with their longstanding practice of not disclosing root-cause class in CPU advisories; based on the description (HTTP attack vector, low privileges, full CIA impact and 'takeover' wording), the underlying weakness is most plausibly an authorization or input-handling flaw in an EBS servlet/JSP that elevates a low-privileged user to full control of the Quality module.

RemediationAI

Apply the patch available per vendor advisory by installing the Oracle E-Business Suite fixes shipped in the June 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html); Oracle does not publish a discrete fixed micro-version for EBS modules, so the CPU patch set itself is the authoritative remediation. Until the CPU can be applied, reduce exposure by restricting network access to the EBS application tier so that only trusted internal users can reach Oracle Quality URLs (for example via WAF/reverse-proxy ACLs on the Oracle Quality responsibility endpoints), and review and tighten EBS responsibilities so that the population of low-privileged accounts able to authenticate to the Quality module is minimized; both controls have the side effect of blocking some legitimate self-service users and should be coordinated with the EBS functional owners. Monitor EBS access logs for anomalous low-privileged session activity against Quality module URLs during the window before patching.