What is the CVSS score of EUVD-2026-46519?

EUVD-2026-46519 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Contracts Integration are affected by EUVD-2026-46519?

Oracle E-Business Suite Contracts Integration (CVE-2026-47033) contains a privilege escalation flaw allowing low-privileged authenticated users to fully compromise the component and impact dependent…

How to fix or mitigate EUVD-2026-46519?

Within 24 hours, restrict network and application-level access to Oracle E-Business Suite Contracts Integration module (versions 12.2.3-12.2.15) to essential personnel only, enable detailed audit logging for all transactions and user actions, and alert the information security team to monitor for suspicious administrator activity. Within 7 days, identify all upstream and downstream connected systems receiving data from Contracts Integration and implement enhanced network segmentation if not already in place; also implement role-based access controls limiting administrative and sensitive-data-access privileges to validated business owners. Within 30 days, monitor Oracle's security advisories for patch releases, complete penetration testing of the isolated Contracts module to validate compensating controls, and deploy endpoint detection and response capabilities to systems running affected versions to detect and respond to exploitation attempts.

Oracle Contracts Integration EUVD-2026-46519

| CVE-2026-47033 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-ppwp-hq7q-2x2q

Authentication Bypass Oracle Oracle Contracts Integration Oracle Corporation

8.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.5 HIGH

Network HTTP reach with required low-privileged auth (PR:L) and vendor-stated difficulty (AC:H); scope change and total C/I/A takeover justify S:C and H impacts.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:25 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 8.5

DescriptionCVE.org

Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contracts Integration. While the vulnerability is in Oracle Contracts Integration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Contracts Integration. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privilege escalation and full component takeover affects Oracle Contracts Integration within Oracle E-Business Suite (Internal Operations component), versions 12.2.3 through 12.2.15, where a low-privileged, network-authenticated attacker can compromise the component and, due to a scope change (S:C), significantly impact additional connected products. Rated CVSS 3.1 8.5 (High) with full confidentiality, integrity, and availability loss, though the attack is flagged as difficult to exploit (AC:H). No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Technical ContextAI

Oracle Contracts Integration is a module of the Oracle E-Business Suite (EBS) enterprise application platform, specifically tied to the Internal Operations component that brokers data and process flows between EBS modules. The scope-change flag (S:C) in the CVSS vector indicates the vulnerable component operates in a security context that can affect resources beyond its own authorization boundary - consistent with EBS's shared middle-tier and database trust model where one compromised module can pivot into others. No CWE was assigned in the source data, so the precise root-cause class (e.g., injection, access-control flaw, or deserialization) cannot be confirmed from the provided intelligence; Oracle's quarterly Critical Patch Update advisories typically withhold technical detail. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_contracts_integration, confirming the product identity but not the underlying library or protocol beyond the stated HTTP delivery.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html), which is the primary and vendor-supported remediation; a specific fixed build version is not enumerated in the provided data, so consult the CPU patch matrix for the exact patch corresponding to your EBS 12.2.3-12.2.15 release. Patch available per vendor advisory. Until patching is complete, reduce exposure by restricting network access to the EBS application tier so only trusted internal networks and VPN users can reach it, tightening EBS user account provisioning to minimize the pool of low-privileged accounts (since PR:L is required), and monitoring the Contracts Integration and Internal Operations endpoints for anomalous HTTP activity - noting the trade-off that restricting application-tier access may disrupt legitimate integrations and remote user workflows. Because Oracle does not publish detailed workarounds in CPUs, disabling unused EBS modules and enforcing least privilege on integration accounts are the most concrete compensating controls available.