Oracle Product Workbench EUVD-2026-46503

Exploitation requires network access to the Oracle E-Business Suite web tier over HTTP and, per the CVSS vector (PR:L), a valid low-privileged EBS account authenticated to the Product Workbench application; no user interaction is needed and attack complexity is low. The affected deployment must be running Oracle EBS 12.2.3 through 12.2.15 with the Product Workbench (Security component) accessible. Limiting factors: the low-privilege authentication requirement means a fully anonymous unauthenticated attacker cannot trivially exploit it if account provisioning and network exposure are tightly controlled - though note Oracle's 'Authentication Bypass' tag conflicts with PR:L and, if the tag is accurate, the authentication prerequisite may not hold; verify against the Oracle advisory. Internet-exposed EBS instances materially increase realistic risk.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1) indicates a genuinely high-severity issue: remotely reachable over HTTP, low attack complexity, no user interaction, and requiring only low privileges (PR:L), yielding full confidentiality and integrity loss with no availability impact. Oracle explicitly labels it 'easily exploitable,' which aligns with AC:L. However, key corroborating signals are absent: no EPSS score, no POC, and no CISA KEV listing were provided, so there is no public evidence of active or imminent exploitation despite the high base score - treat as high-priority patching but not confirmed in-the-wild. A notable conflict exists between the Oracle tag 'Authentication Bypass' (which implies no valid credentials needed) and the CVSS vector's PR:L (which requires a valid low-privileged account); this should be verified against the Oracle advisory, as it materially changes the threat model. Given EBS's role as a crown-jewel ERP system holding sensitive business data, real-world risk to exposed or insufficiently segmented deployments is meaningful.

An attacker who holds or obtains a low-privileged Oracle E-Business Suite account (or reaches an exposed EBS web tier) sends crafted HTTP requests to the Product Workbench Security component and, exploiting the flaw, gains unauthorized read and write access to all data the application can reach - enabling theft of sensitive product/business data or unauthorized creation, modification, and deletion of critical records. No user interaction or high privileges are required, and Oracle rates the issue easily exploitable; however, no public POC or exploit code has been identified at time of analysis.