EUVD-2026-47103
GHSA-r52c-78hj-q877
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privileged EBS account
-
DeliveryReach Receivables Internal Operations over HTTP
-
ExploitSend crafted request exploiting flaw
-
ExecutionTake over Oracle Receivables module
-
ImpactRead/modify/destroy financial data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold high privileges within Oracle E-Business Suite (CVSS PR:H) and network HTTP reachability to the Oracle Receivables Internal Operations component; it targets EBS installations running Oracle Receivables at supported versions 12.2.3-12.2.15. The chief limiting factor is the high-privilege prerequisite - this is not exploitable by an unauthenticated or low-privileged remote actor - while the enabling factors are the network attack vector, low complexity, and no required user interaction, meaning any HTTP-reachable, unpatched EBS 12.2.x with a compromised privileged account is at risk. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 7.2 High) shows a network-reachable, low-complexity, no-user-interaction attack that nonetheless demands high existing privileges (PR:H), which is the single largest limiting factor - an attacker must already hold a privileged EBS account. There is no EPSS score, no POC, and no KEV listing in the provided data, so exploitation-probability signals are absent rather than confirmed-low; this reads as a priority to patch for internet-exposed EBS estates but not an emergency drive-by risk. Note a conflict worth verifying with Oracle: the vendor tag says 'Information Disclosure' while the full C/I/A-high impacts and 'takeover' wording imply far more than disclosure - treat impact as full compromise. Oracle's 'easily exploitable' phrasing aligns with AC:L but does not override the PR:H prerequisite. |
| Exploit ScenarioDerived | An attacker who has obtained a high-privileged Oracle E-Business Suite account (via prior credential theft, insider access, or an earlier foothold) sends crafted HTTP requests to the Oracle Receivables Internal Operations component and leverages the flaw to take over the module, reading, altering, or destroying receivables and financial data. No user interaction is needed and attack complexity is low, but the requirement for existing high privileges constrains this to already-authorized or previously-compromised privileged users; no public exploit code is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Full compromise of Oracle Receivables (Oracle E-Business Suite, Internal Operations component) is possible in versions 12.2.3 through 12.2.15, where a high-privileged attacker with network HTTP access can take over the module, impacting confidentiality, integrity, and availability. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable, though it requires existing high privileges (PR:H). No public exploit has been identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle delivers EBS 12.2 security fixes as cumulative CPU patches for the 12.2 codeline rather than as a new base version, so identify and apply the specific CPU patch for your 12.2.x level (no exact fixed-version string is provided in the input, so confirm the patch number in the CPU matrix). Until patched, reduce exposure by restricting network HTTP access to the EBS/Oracle Receivables endpoints to trusted internal networks or VPN, tightening and reviewing accounts that hold high EBS privileges since exploitation requires PR:H (revoke unneeded elevated roles, enforce strong authentication/MFA), and increasing monitoring of privileged Receivables activity - trade-offs include potential disruption to legitimate remote or integration access when restricting the front end. Because Oracle CPU details are cumulative, applying the CPU also remediates other July 2026 EBS issues.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Receivables is the accounts-receivable module of Oracle E-Business Suite (EBS), Oracle's on-premises ERP platform, and the flaw sits in its Internal Operations component reached over HTTP. Oracle does not publish a CWE for this issue (CWE: N/A) and gives no root-cause class in the advisory, so the specific weakness (e.g., authorization, injection, or logic flaw) cannot be determined from available data. The 'takeover of Oracle Receivables' language combined with C:H/I:H/A:H indicates the vulnerability yields full control of the module's data and functions rather than a narrow disclosure, despite the vendor tag of 'Information Disclosure.'
Know when Receivables gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network HTTP reachable and low complexity, but requires existing high EBS privileges (PR:H); full module takeover yields C:H/I:H/A:H with no scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Receivables product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Receivables. Successful attacks of this vulnerability can result in takeover of Oracle Receivables. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Receivables (E-Business Suite versions 12.2.3-12.2.15) is vulnerable to full system compromise via HTTP access by high-privilege users, directly threatening financial data integrity and availability. This impacts organizations using affected EBS versions for order-to-cash and revenue operations. No vendor-released patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict HTTP network access to Receivables module to trusted administrative networks only; implement privileged access management (PAM) solutions to monitor and control all administrative activities; conduct weekly access reviews of Receivables administrative users; isolate Receivables instances on segregated network segments with firewall rules limiting administrative access points.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Receivables
View allVulnerability in the Oracle Receivables product of Oracle E-Business Suite (component: Receipts). Rated high severity (C
Full compromise of Oracle Receivables (the accounts-receivable module of Oracle E-Business Suite 12.2.3 through 12.2.15)
Exploit-DB