Oracle Property Manager EUVD-2026-37267

Exploitation requires (1) network reachability to the Oracle E-Business Suite 12.2 HTTP application tier serving the Property Manager module, specifically the Internal Operations component, and (2) an authenticated session with high EBS application privileges (PR:H) - typically a user holding a privileged Property Manager / System Administrator responsibility - as Oracle's CVSS vector mandates PR:H and explicitly scopes impact to the Oracle Property Manager module. No user interaction is required (UI:N) and the deployment must run an affected version in the 12.2.3-12.2.15 range; deployments where the Property Manager module is not licensed/installed or where Internal Operations URLs are not exposed to the attacker's network segment are not exploitable, which is a meaningful limiting factor versus a PR:N internet-facing flaw.

Oracle's CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2) describes a high-impact but high-privilege flaw: full triad compromise of Property Manager, but only by an attacker already holding elevated EBS privileges, which materially lowers real-world likelihood versus a PR:N RCE. No EPSS score, no KEV listing, and no public POC are provided, and the issue is not on CISA KEV, so this is not evidence of opportunistic mass exploitation. Realistic risk is concentrated in insider-threat and post-compromise lateral-movement scenarios where an attacker has already obtained a privileged EBS account (e.g., via credential theft, phishing of a functional admin, or chaining with a separate auth bypass). Key data gaps: Oracle CPUs intentionally omit technical detail, so root cause, exact attack surface, and exploit complexity beyond AC:L are unverified, and the Oracle 'easily exploitable' label conflicts mildly with the operational reality that PR:H access in EBS is non-trivial to obtain.

An attacker who has already obtained a privileged Oracle EBS account - for example through phishing of a functional administrator or reuse of a stolen DBA/sysadmin credential - authenticates to the EBS application tier and issues a crafted HTTP request to a Property Manager Internal Operations endpoint, achieving full takeover of the Property Manager module including read, modification, and disruption of lease and property records. No public exploit identified at time of analysis, so an adversary would need to reverse the June 2026 CPU patch or discover the vulnerable code path independently.