Oracle E-Business Suite EUVD-2026-37285

Attacker must already hold a high-privileged Oracle E-Business Suite account with access to the Public Sector Payroll module's Internal Operations component (CVSS PR:H), and must be able to reach the EBS HTTP/HTTPS tier (AV:N). No user interaction is required (UI:N) and attack complexity is low (AC:L). Exploitation is limited to deployments running supported EBS 12.2.3-12.2.15 with the Public Sector Payroll module licensed and installed; environments without Public Sector Payroll, or with the Internal Operations endpoints firewalled away from privileged users, are not realistically reachable.

The signals are mixed and net out to a moderate, internally-focused priority rather than an emergency. CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H yields 7.2 (High) with full CIA impact, but PR:H means the attacker must already hold high privileges inside EBS, which substantially reduces the realistic attacker pool. There is no CISA KEV listing, no EPSS score provided, no public POC, and no SSVC decision supplied in the input - so exploitation likelihood signals are absent rather than negative. The Oracle advisory describes the bug as 'easily exploitable' once privileges are obtained, which is consistent with AC:L, so a malicious or compromised privileged EBS user (e.g., a payroll super-user or sysadmin responsibility holder) is the dominant threat model. Note that Oracle's tag set includes 'Information Disclosure' which is narrower than the description's 'takeover' language - defenders should treat the description as authoritative and verify scope with Oracle support.

A payroll super-user account is phished or otherwise compromised; the attacker authenticates to Oracle EBS over HTTPS, navigates to the Public Sector Payroll Internal Operations functionality, and submits a crafted request that abuses the vulnerable code path to read, modify, or destroy payroll data and ultimately take over the module. No public POC is known, so an attacker would likely need to reverse-engineer the Oracle CPU patch to derive a working exploit.