Oracle E-Business Suite EUVD-2026-47086

Exploitation requires the attacker to have an active local logon session on the server infrastructure where Oracle Applications Technology Stack executes - remote network-based attacks are not supported by this vulnerability. The attacker must hold high operating system or application-level privileges on that host (PR:H). The affected configuration is present in any supported EBS deployment running versions 12.2.3 through 12.2.15; no specific non-default feature flag or configuration toggle is mentioned as a prerequisite in the description, suggesting the vulnerable Configuration component is present in standard deployments within this version range. Exploitation is rated as difficult (AC:H), implying additional environmental conditions or timing requirements exist beyond basic access. No user interaction is required once the attacker has infrastructure access. Exploitation is limited by the requirement for physical or logical local access to the EBS host and high privilege, making this inaccessible to remote unauthenticated attackers and significantly reducing its exploitation surface compared to network-facing vulnerabilities.

The official CVSS 3.1 score of 5.7 reflects a moderate-risk vulnerability constrained by three compounding factors: local access vector (AV:L), high attack complexity (AC:H), and high privilege requirement (PR:H). Despite the C:H and I:H impact ratings - which represent full data access and modification potential - these prerequisites severely limit the realistic attacker pool to insiders, compromised privileged accounts, or attackers who have already achieved deep foothold on the EBS infrastructure. The 'Authentication Bypass' tag creates a mild tension with PR:H: if a bypass exists, it may reduce the effective privilege threshold in practice, though no independent evidence confirms this reduces the CVSS prerequisites. No EPSS score was provided, no POC is known, and the vulnerability is not listed in the CISA KEV catalog. SSVC signals suggest Exploitation=None, Automatable=No (AC:H, AV:L), Technical Impact=Total (C:H/I:H) - meaning this is a real-impact but low-immediacy issue appropriate for patch-cycle remediation rather than emergency response. The primary real-world risk is insider threat or post-compromise lateral movement by an attacker who has already breached the EBS host.

An attacker who has already compromised a high-privileged OS or middleware account on the EBS application server - through credential theft, insider access, or lateral movement - exploits the Configuration component's improper authorization enforcement to read or tamper with critical EBS data stores beyond their intended access scope. If the 'Authentication Bypass' tag reflects a real weakening of authorization checks, the attacker may leverage the Configuration interface to escalate access to data records, application configuration secrets, or user credential stores accessible to the EBS stack. No public proof-of-concept code has been identified, and the high complexity rating indicates reliable exploitation may require specific timing or environmental conditions.