Oracle E-Business Suite EUVD-2026-47137

Exploitation requires the attacker to already hold high application privileges within Oracle E-Business Suite (CVSS PR:H) and network HTTP access to the HCM Common Architecture / Internal Operations component; there is no user-interaction requirement (UI:N) and complexity is low (AC:L). It applies specifically to EBS deployments running the Oracle HCM Common Architecture module at versions 12.2.3 through 12.2.15. The key limiting factor is the high-privilege prerequisite - this is not exploitable by anonymous or low-privileged users, so realistic risk is concentrated in insider-abuse or post-compromise escalation scenarios, and instances whose application tier is not reachable over the network are further shielded.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) is the primary and only quantitative signal available. Attack vector is network with low complexity and no user interaction, but PR:H means the attacker must already possess high application privileges - a significant gating factor that lowers real-world risk versus an unauthenticated flaw. No EPSS score, no SSVC decision, and no CWE were provided in the input, so probabilistic and automatability signals cannot be assessed. It is not in CISA KEV and no POC is referenced, so there is no evidence of active exploitation. Note a tension worth verifying with Oracle: the vendor tag says 'Information Disclosure' yet the vector claims full integrity and availability impact and 'takeover' - treat the impact as takeover per the CVSS vector, but the discrepancy suggests the public tag understates severity. Net: a genuine high-severity issue for exposed EBS instances, but the PR:H requirement makes it more a privilege-abuse/insider or post-compromise escalation risk than a mass-exploitation threat.

An attacker who has obtained a high-privilege Oracle EBS application account - for example a compromised administrator credential or a malicious insider - sends crafted authenticated HTTP requests to the HCM Common Architecture Internal Operations component. Because the flaw is low-complexity and requires no user interaction, the requests result in full takeover of the HCM module, exposing and altering sensitive HR data and disrupting availability. No public POC is referenced, so exploitation would require the attacker to develop the technique independently.