Oracle Cash Management EUVD-2026-47076

Exploitation requires network access over HTTP to an Oracle E-Business Suite 12.2.3-12.2.15 deployment running the Oracle Cash Management module (Internal Operations component), plus at least a low-privileged authenticated EBS account (CVSS PR:L). No user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker must possess valid low-privilege credentials and be able to reach the application's HTTP interface, so deployments that restrict EBS access to internal networks and enforce tight account provisioning materially reduce exposure. Note the unresolved tension between the 'Authentication Bypass' tag and the PR:L requirement - if Oracle confirms a true pre-authentication path, the credential prerequisite would not apply.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N yields 8.1 (High): network-reachable, low complexity, no user interaction, requiring only low privileges, with high confidentiality and integrity impact and no availability impact. No EPSS score was provided, so exploitation probability cannot be quantified here. The CVE is not in CISA KEV and no POC or public exploit was identified, so there is no evidence of active exploitation. A signal to flag explicitly: the 'Authentication Bypass' tag conflicts with the CVSS PR:L metric, which requires the attacker to already hold low-level credentials - verify with Oracle whether any authenticated EBS account suffices or whether a genuine pre-auth path exists, as this materially changes exposure. Given Oracle EBS's role as a sensitive financial ERP system, a flaw permitting unauthorized modification of Cash Management data is a real priority for exposed or internally-reachable deployments, but the low-privilege account requirement tempers risk relative to a fully unauthenticated CVSS-8.1 issue.

A low-privileged EBS user, or an attacker who has obtained such credentials via phishing or reuse, sends crafted HTTP requests to Oracle Cash Management endpoints and, exploiting the access-control weakness, reads and alters financial cash-management records they should not be authorized to touch. With no public POC identified and low attack complexity, the practical barrier is obtaining any valid low-privilege account plus network access to the application tier.