Oracle Demand Signal Repository EUVD-2026-47140

Exploitation requires a valid low-privileged account with network access to the Oracle Demand Signal Repository application (CVSS PR:L, AV:N), reaching the affected 'Internal Operations' component of an EBS 12.2 install running a version between 12.2.3 and 12.2.15; the attack is performed 'via SQL' against that component. What limits it: the attacker must first authenticate (PR:L - not a confirmed pre-auth path despite the 'Authentication Bypass' tag), the DSR module must be deployed and network-reachable, and only in-scope EBS 12.2.3-12.2.15 releases are affected. No user interaction and no special non-default toggle is documented, so any deployment where a low-privileged user can reach DSR is exposed.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) signals an easily exploitable, network-reachable flaw needing only low privileges and no user interaction - a genuine priority for internet- or intranet-exposed EBS deployments. However, several corroborating signals are missing: no EPSS probability was supplied, there is no POC, and it is not on CISA KEV, so there is no evidence of active or automated exploitation yet - consistent with a freshly disclosed Oracle CPU item rather than a widespread campaign. One conflict to flag: the source tag reads 'Authentication Bypass,' but the CVSS vector specifies PR:L (a low-privileged, already-authenticated attacker), so the tag likely reflects post-auth privilege/data escalation rather than a true pre-auth bypass - verify with Oracle before treating it as unauthenticated. Net: high-severity and worth prompt patching, but currently unproven in the wild.

An attacker who already holds a low-privileged EBS/DSR application account (or has phished such credentials) sends crafted input through a DSR Internal Operations function over the network, injecting SQL that the module executes against the shared EBS schema. With no user interaction and low attack complexity, the attacker exfiltrates or silently alters critical demand and supply-chain data across everything the application account can access. No public POC is currently known, so exploitation would require the attacker to develop the technique independently.