Oracle EAM EUVD-2026-46950

Exploitation requires a valid low-privileged account on the Oracle E-Business Suite instance (PR:L) with network access to the application's HTTPS interface. The target system must be running Oracle Enterprise Asset Management version 12.2.3 through 12.2.15. No user interaction from a privileged user is required once network access is established. Limiting factors include: (1) the attacker must already hold authenticated access to the EBS instance - this is not an unauthenticated attack; (2) the impact is scoped to EAM-accessible data only (S:U), not full system compromise; (3) there is no availability impact, limiting the attacker's destructive capability to data manipulation and exfiltration. The vulnerability requires no special non-default configuration - any standard deployment of the affected EAM versions is susceptible once a low-privileged account is obtained.

The CVSS 3.1 Base Score of 5.4 (Medium) reflects a network-accessible, low-complexity flaw requiring low privileges with no user interaction, resulting in partial confidentiality and integrity impacts but no availability impact (S:U/C:L/I:L/A:N). Real-world risk is moderate: the PR:L requirement means an attacker must already hold a valid account on the Oracle EBS instance, which materially limits the attack surface compared to unauthenticated network exploits. No EPSS score was provided in the input data, and EPSS cannot be inferred. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no proof-of-concept exploit code has been identified at time of analysis. The 'Authentication Bypass' tag introduces a nuance: if the bypass allows privilege escalation from a low-privileged EBS user to access sensitive asset management data, the business risk in asset-heavy regulated industries (utilities, critical infrastructure) could exceed what the numeric CVSS score implies. The CVSS score and description are internally consistent; no conflicting signals were identified, though the absence of a CWE limits root-cause confidence.

An attacker with a low-privileged Oracle E-Business Suite account - such as a contractor, read-only auditor, or compromised internal credential - connects to the EBS HTTPS interface and targets the Work Definition Issues component within Enterprise Asset Management. By crafting specific HTTPS requests that exploit the authorization control weakness, the attacker bypasses the intended access controls and reads asset management records or inserts, modifies, or deletes work definition data outside their permitted scope. No public proof-of-concept exploit code exists at time of analysis, so exploitation currently requires knowledge of the application's internals or independent discovery.