Oracle E-Business Suite EUVD-2026-46517

The attacker must have a valid low-privileged Oracle E-Business Suite account (CVSS PR:L - authenticated) and network HTTP reachability to the EBS web tier hosting the Bills of Material 'Bill Issues' component; the target must be running an affected 12.2.3-12.2.15 release. No user interaction is required (UI:N) and attack complexity is low (AC:L), so any authenticated user on a reachable, unpatched instance can attempt it. What limits exploitation is the authentication requirement and network reachability: instances whose EBS front end is confined to a trusted internal network or VPN, or that have already applied the July 2026 CPU, are not exposed to anonymous internet attackers. The precise vulnerable feature/parameter within Bill Issues is not disclosed by Oracle.

The CVSS vector (AV:N/AC:L/PR:L/UI:N) signals a genuinely dangerous, easily repeatable attack: reachable over the network, low complexity, no user interaction, and only a low-privileged account required, yielding high confidentiality, integrity, and availability impact (8.8). Oracle self-reported this and rates exploitation as 'easily exploitable,' which raises priority. However, no EPSS score, no SSVC decision data, and no POC were provided, and it is not in CISA KEV, so there is no evidence of active or automated exploitation yet - the risk today is potential rather than confirmed in-the-wild. One caveat worth verifying: the tag 'Information Disclosure' understates the described full 'takeover' with high integrity and availability impact, so treat the CVSS high-impact rating, not the tag, as authoritative. Net: a real patch-now priority for any internet- or intranet-reachable EBS instance because the barrier (one low-privilege account) is low, even though widespread exploitation is not yet demonstrated.

An attacker who holds or phishes any low-privileged Oracle EBS application account authenticates to the internet- or intranet-facing EBS web tier and sends a crafted HTTP request to the vulnerable Bill Issues functionality of Bills of Material. Because attack complexity is low and no user interaction is needed, a single request chain lets them read, modify, and destroy Bills of Material data, achieving full takeover of the module. No public proof-of-concept has been identified at time of analysis, so exploitation currently requires the attacker to derive the technique independently.