Oracle Price Protection EUVD-2026-47136

The attacker must possess a valid, low-privileged Oracle E-Business Suite account with network access to the application via HTTP - exploitation does not require administrative or Price Protection-specific roles. The affected component is 'Internal Operations' within the Price Protection module; the vulnerability exists when this module is deployed and accessible over the network. Exploitation is limited to the confidentiality plane - no write, modify, or availability impact is possible. Environments where EBS access is restricted to internal networks or VPNs reduce attack surface to internal or VPN-connected threat actors only. Default EBS configurations that expose the web tier to broad networks represent the highest-risk deployment posture.

The CVSS 3.1 score of 6.5 (Medium) reflects network accessibility, low complexity, and low privilege requirement - all elevating real-world risk above what the numeric score alone suggests. AV:N/AC:L/PR:L/UI:N means any authenticated EBS user on the network can trigger this with minimal technical skill. The confidentiality impact is rated High (C:H), meaning full access to all Price Protection data is achievable, which in a commercial ERP context includes sensitive supplier agreements and pricing strategies. EPSS data is not available in the provided intelligence, but the combination of low complexity and broad network exposure suggests meaningful exploitation probability. No KEV listing or public POC has been identified, limiting immediate threat actor activity evidence. The 'Authentication Bypass' tag creates a mild signal conflict with PR:L: the attacker still requires some valid credentials, but those credentials alone should not grant access to the data exposed - defenders should not interpret PR:L as meaning 'only authenticated users can see it anyway.'

An attacker with any valid Oracle E-Business Suite account - such as a contractor or low-privileged internal user - authenticates to EBS via the web tier and sends a crafted HTTP request targeting an Internal Operations endpoint within the Price Protection module. By exploiting the authorization bypass, the attacker retrieves complete pricing agreement data, supplier credit terms, and other confidential commercial records without requiring elevated roles. No public POC exists at time of analysis, but the low attack complexity means a motivated attacker could develop an exploit through manual parameter manipulation or endpoint enumeration.