Oracle TeleSales EUVD-2026-47109

Exploitation requires a valid, low-privileged user account with network access to the Oracle E-Business Suite HTTP interface - specifically the TeleSales Internal Operations component. The attacker must be authenticated to EBS (PR:L per CVSS), ruling out fully anonymous exploitation. Exploitation is limited to versions 12.2.3 through 12.2.15; customers on patched CPU releases are not affected. No specific non-default configuration is described as a prerequisite, suggesting this affects standard TeleSales deployments. Limiting factors include: (1) requirement for a valid EBS user credential, (2) network reachability to the EBS HTTP endpoint, and (3) impact is bounded to confidentiality and integrity of TeleSales-accessible data only - no code execution, no availability impact, and no cross-system scope change.

The raw CVSS score of 5.4 (Medium) is calibrated appropriately given the constrained impact (C:L/I:L/A:N) and the PR:L prerequisite. No EPSS score is available from the provided data, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, and no POC has been identified, indicating no confirmed widespread exploitation at time of analysis. That said, Oracle's own characterization of this as 'easily exploitable' (AC:L/UI:N) combined with the 'Authentication Bypass' tag elevates practical concern above what a 5.4 score alone might suggest: any authenticated EBS TeleSales user, including low-trust sales staff or external portal users, could potentially read or tamper with data outside their intended scope. In organizations where EBS is internet-facing or accessible via partner/agent portals, the realistic attack surface is broader than in strictly internal deployments. The absence of availability impact reduces urgency compared to code execution flaws, but data integrity risk in a CRM system (customer records, opportunity data, pricing) carries real business consequence. IMPORTANT: The 'Authentication Bypass' tag conflicts slightly with the PR:L CVSS metric - if this were a true authentication bypass, PR:N would be expected. This discrepancy should be clarified with the Oracle advisory.

An attacker with a valid low-privileged EBS TeleSales account - such as a standard sales representative or a compromised service account - sends crafted HTTP requests to the Internal Operations component, exploiting the authorization control gap to read customer opportunity records or sales data outside their assigned territory, or to modify pricing or order data without the required role. No public exploit code has been identified, but Oracle's 'easily exploitable' classification suggests that exploitation would not require significant technical skill once access to the EBS instance is available.