Oracle Advanced Pricing EUVD-2026-46883

No special configuration is required beyond HTTP network connectivity to the Oracle E-Business Suite application tier running versions 12.2.3 through 12.2.15. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against the default Price List component without any non-standard configuration. Exploitation is limited to the confidentiality and integrity of Oracle Advanced Pricing data - it does not grant operating system access or affect availability. The primary limiting factor for most organizations is whether the EBS HTTP interface is network-accessible from untrusted segments; organizations that isolate EBS behind strict internal network controls or authenticated reverse proxies reduce their exposure window significantly.

The CVSS 3.1 score of 6.5 reflects a meaningful but bounded risk profile: network-accessible, zero-complexity, unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N), but with only partial confidentiality and integrity impacts and no availability impact (C:L/I:L/A:N). This is not a full system compromise - the attacker can read a subset of pricing data and make unauthorized inserts, updates, or deletes to price list records, which could facilitate business logic fraud (e.g., unauthorized price manipulation) rather than direct infrastructure takeover. No EPSS data was provided in the intelligence feed; however, the lack of KEV listing and absence of any known POC reduces the immediate operational urgency. The authentication bypass nature, combined with the low attack complexity, means exploitation is accessible to low-skilled attackers if the EBS HTTP interface is exposed to untrusted networks - this should be weighted heavily. For organizations where Oracle EBS faces the internet or is accessible from untrusted internal segments, patching priority is elevated.

An attacker with HTTP network access to an Oracle E-Business Suite instance sends crafted requests to the Price List endpoint within Oracle Advanced Pricing, bypassing authentication controls. Without needing credentials, the attacker reads sensitive pricing data and issues unauthorized inserts or updates to price list records - potentially manipulating product pricing to enable fraudulent order processing. No public POC is known at time of analysis, but the low attack complexity means the bypass can likely be replicated through standard HTTP enumeration of the EBS URL structure.