What is the CVSS score of EUVD-2026-37278?

EUVD-2026-37278 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate EUVD-2026-37278?

Within 24 hours: Identify and inventory all systems running Oracle Public Sector Financials versions 12.2.3-12.2.15; document current network exposure and user access patterns. Within 7 days: Implement network segmentation to restrict HTTP access to affected systems; deploy enhanced monitoring for privilege escalation attempts; enforce principle of least privilege across user accounts. Within 30 days: Establish direct communication with Oracle to confirm patch timeline for versions 12.2.16+; develop and test upgrade path; execute remediation once patch is released and validated.

Oracle E-Business Suite EUVD-2026-37278

| CVE-2026-46967 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Public Sector Financials International Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain low-privileged EBS account
Delivery

Reach EBS HTTP application tier
Exploit

Send crafted request to Public Sector Financials (International) endpoint
Execution

Bypass authorization check
Persist

Execute privileged module operations
Impact

Full takeover of Public Sector Financials data

Vulnerability Assessment

Weakness	CWE CWE-284 MITRE ATT&CK 1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires (1) a reachable HTTP/HTTPS endpoint of an Oracle E-Business Suite 12.2.3-12.2.15 instance with the Public Sector Financials (International) localization module deployed and enabled, and (2) valid credentials for any low-privileged EBS account (PR:L) - anonymous exploitation is not in scope per the CVSS vector. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Exploitation is naturally limited to environments that have specifically licensed and provisioned the Public Sector Financials (International) module - organizations using EBS Financials without this international/public-sector localization are not affected even on the same 12.2 versions.
Impact	The combined signals point to a high real-world priority for any organization running Oracle EBS 12.2 with this module enabled. CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N with C:H/I:H/A:H reflects a network-reachable, low-complexity attack that requires only a low-privileged account (any authenticated EBS user) and no user interaction, and Oracle explicitly characterizes it as 'easily exploitable' resulting in 'takeover' of the module. No EPSS score or KEV listing was provided in the input, and there is no evidence of a public POC, so right now exploitation is theoretical rather than mass-scanned. The mismatch worth flagging: Oracle classifies the impact as full takeover (C:H/I:H/A:H), yet the provided tags only mention 'Information Disclosure' - defenders should trust the CVSS impact metrics and Oracle's advisory text over the tag, which appears under-scoped.
Exploit ScenarioDerived	An attacker who has obtained or registered any low-privileged EBS account - for example, a self-service user, a former contractor, or a phished employee - sends crafted HTTP requests to the Public Sector Financials (International) module endpoints and bypasses authorization checks to perform privileged operations, ultimately gaining full takeover of the module's data and workflows. Because Oracle rates the issue as easily exploitable with AC:L and no user interaction, repeatable exploitation against an exposed instance is realistic once the patch is reverse-engineered, even though no public exploit identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 16, 2026

Authorization flaw in Oracle Public Sector Financials (International) versions 12.2.3 through 12.2.15 enables low-privileged authenticated attackers with HTTP network access to fully take over the affected component. Oracle's Critical Patch Update describes the issue as easily exploitable with high impact to confidentiality, integrity, and availability (CVSS 8.8). No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

RemediationAI

Apply the Oracle Critical Patch Update referenced in the June 2026 advisory at https://www.oracle.com/security-alerts/cspujun2026.html; Oracle's CPU bundles the fix for CVE-2026-46967 across the 12.2.3-12.2.15 supported branches and specific patch numbers must be retrieved from My Oracle Support for the deployed version (exact patched build identifier not independently confirmed beyond the CPU advisory). Until the CPU is applied, restrict network reachability of the EBS application tier to trusted internal networks via firewall or WAF rules, tighten the EBS responsibility/role assignments so that low-privileged accounts cannot reach Public Sector Financials (International) menus or URLs, and increase audit logging on the FND_LOGINS/FND_LOG_MESSAGES tables to detect anomalous use of the module - note these controls reduce but do not remove exposure, since any authenticated EBS user with HTTP reachability remains a viable attack origin.

Affected VersionsENISA

Oracle Public Sector Financials (International) 12.2.3 ≤12.2.15

Affected Packages

euvd oracle_public_sector_financials_international no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle Public Sector Financials (International) is a localization module within Oracle E-Business Suite 12.2, an on-premises ERP platform used by government and public-sector organizations for financial management. The affected component is Authorization, indicating a broken access control class of weakness (CWE-285/CWE-862-style) in which the module fails to properly verify that an authenticated user is permitted to perform a given action over HTTP. While Oracle did not publish a specific CWE and the CPE string (cpe:2.3:a:oracle_corporation:oracle_public_sector_financials_(international):*) does not enumerate sub-versions, Oracle's advisory text scopes the defect to EBS 12.2.3 through 12.2.15, meaning every supported 12.2 release line is in scope.

Know when Oracle Public Sector Financials International gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

HTTP-reachable EBS module exploitable by any authenticated low-privileged user (PR:L) with no interaction or complexity, yielding full module takeover (C/I/A:H), scope unchanged within EBS.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Authorization). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Financials (International). Successful attacks of this vulnerability can result in takeover of Oracle Public Sector Financials (International). CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive ViewAI

Why It Matters

Oracle Public Sector Financials versions 12.2.3 through 12.2.15 contain an authorization flaw enabling low-privileged authenticated users to gain complete control over the affected system, creating direct risk to financial data integrity, system availability, and operational continuity for public sector organizations. With no patch currently available, this vulnerability requires immediate interim protective measures to prevent unauthorized manipulation of critical budgeting and financial systems. Organizations running vulnerable versions should treat this as a priority remediation item pending vendor patch release.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict HTTP network access via firewall and VPN; (2) Deploy real-time alerting for unauthorized privilege escalation; (3) Enforce strong authentication policies and disable unnecessary user accounts; (4) Maintain comprehensive audit logging of all financial transactions and system access; (5) Establish offline backup procedures for critical financial data; (6) Maintain active communication with Oracle for patch availability and security guidance.

Threat Intelligence Overview

EPSS Score

0.4%

Top 65% exploitable

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.