EUVD-2026-47119
GHSA-xw84-49hh-wvfv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach EBS web tier over HTTP
-
DeliverySend request to Collaboration History endpoint
-
ExploitBypass authentication check
-
ExecutionRead Supply Chain Trading Connector data
-
ImpactExfiltrate or tamper with partner records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against Oracle Supply Chain Trading Connector (EBS 12.2.3-12.2.15), per AV:N/AC:L/PR:N/UI:N. The concrete prerequisite is network reachability to the EBS web tier hosting the Supply Chain Trading Connector and its Collaboration History component. The primary limiting factor is exposure: the vulnerable endpoint must be reachable by the attacker, so deployments where the connector is disabled, not provisioned, or firewalled to trusted trading-partner networks only are not exploitable. Version is also limiting - only the 12.2.3 through 12.2.15 range is stated as affected. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, score 8.2) describes a low-effort, network-reachable, unauthenticated attack with high confidentiality impact and limited integrity impact, which is a genuinely serious combination for an ERP system holding sensitive supply-chain and partner data. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input - the assessment rests on the CVSS signal and Oracle's own severity rating alone. There is no conflict between the vector and the description: both indicate remote unauthenticated HTTP access. The main residual uncertainty is real-world exposure (how many EBS instances expose this specific connector to untrusted networks) and whether exploitation is trivial in practice; absent EPSS/KEV this should be treated as a high-priority patch based on impact and reachability rather than confirmed active exploitation. |
| Exploit ScenarioDerived | An attacker who can reach the EBS web tier sends crafted HTTP requests directly to the Supply Chain Trading Connector's Collaboration History endpoints, bypassing authentication, and retrieves sensitive trading-partner and supply-chain records while making limited unauthorized inserts, updates, or deletes. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, victim interaction, or unusual conditions are needed. No public exploit code has been identified at time of analysis, so this scenario is inferred from the CVSS metrics and description rather than a demonstrated PoC. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Unauthenticated data compromise in Oracle Supply Chain Trading Connector (Collaboration History component) of Oracle E-Business Suite 12.2.3 through 12.2.15 allows remote attackers to read all data accessible to the product over HTTP and make limited unauthorized modifications. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 8.2, the flaw is tagged as an authentication bypass and requires no privileges or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network exposure make it a strong patching priority for EBS operators.
RemediationAI
Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships EBS security fixes as cumulative CPU patches for the 12.2 release line rather than a single renamed version, so apply the July 2026 CPU patch level appropriate to your 12.2.x installation - no standalone fixed version string was provided in the input, so consult the CPU patch matrix for your exact release. As compensating controls until patching, restrict network access to the Supply Chain Trading Connector / iSupplier and Collaboration History URLs so they are not reachable from untrusted or internet-facing networks (via reverse-proxy URL firewall / Oracle URL firewall rules), and place EBS behind a VPN or IP allowlist for external trading partners; the trade-off is that legitimate external B2B partners may lose direct connectivity and require whitelisting. If the Supply Chain Trading Connector module is not in use, disable or block its endpoints entirely. Monitor EBS access logs for anonymous HTTP requests to the affected servlets.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected technology is Oracle E-Business Suite (EBS), a large web-based ERP application suite, specifically the Supply Chain Trading Connector (part of the iSupplier/B2B collaboration stack) and its Collaboration History component, which records trading-partner exchange data. The CWE is not assigned in the input, but the 'Authentication Bypass' tag combined with the CVSS PR:N metric points to a broken/missing authentication root cause (CWE-287/CWE-306 class) where an HTTP-facing endpoint can be reached without valid session credentials. EBS exposes these modules through the Oracle Application Server / WebLogic HTTP front end, so any internet- or intranet-reachable EBS deployment presents the vulnerable endpoint. No CPE strings were supplied; affected product identity is derived from the Oracle description and ENISA EUVD entry EUVD-2026-47119.
Know when E Business Suite gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Unauthenticated remote HTTP access with low complexity gives AV:N/AC:L/PR:N/UI:N; high data disclosure (C:H), limited modification (I:L), and no availability impact (A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Supply Chain Trading Connector product of Oracle E-Business Suite (component: Collaboration History). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Supply Chain Trading Connector. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Supply Chain Trading Connector accessible data as well as unauthorized update, insert or delete access to some of Oracle Supply Chain Trading Connector accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
Executive ViewAI
Oracle E-Business Suite versions 12.2.3 through 12.2.15 contain an unauthenticated remote access vulnerability in the Supply Chain Trading Connector that allows attackers to read sensitive supply chain collaboration data and make unauthorized modifications without requiring credentials. Organizations operating affected EBS instances face immediate risk of supply chain data compromise, with potential impacts on partner visibility, contractual compliance, and regulatory reporting requirements. No vendor patch is currently available, requiring urgent deployment of interim mitigations.
Restrict network access to the Supply Chain Trading Connector to internal networks only via firewall rules. Implement enhanced logging and monitoring of all access to the Collaboration History component. Consider disabling or isolating the component if not actively used in operations. Monitor for exploitation attempts and unusual data access patterns. Note: These controls reduce but do not eliminate risk; vendor patch deployment is critical once available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in E Business Suite
View allApache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).
Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, a
Vulnerability in Oracle E-Business Suite (component: Manage Proxies). Rated high severity (CVSS 7.5), this vulnerability
Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 11.5.10.2 all
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 11.5.10.2 all
Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: iSurvey Module). Rated critical sev
Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: OCM Query). Rated
Vulnerability in the Oracle Performance Management component of Oracle E-Business Suite (subcomponent: Performance Manag
Vulnerability in the Oracle General Ledger component of Oracle E-Business Suite (subcomponent: Data Manager Server). Rat
Component takeover in Oracle E-Business Suite's Demand Signal Repository (supported releases 12.2.3 through 12.2.15) let
Exploit-DB