Oracle E-Business Suite EUVD-2026-47143

Requires a valid low-privileged Oracle E-Business Suite account with network HTTP access to the Customer Support module's Update Service Request functionality (CVSS PR:L, AV:N, UI:N) - this is authenticated exploitation, not fully anonymous, despite the 'Authentication Bypass' tag which conflicts with the PR:L vector and should be confirmed with Oracle. The vulnerable code exists only in EBS 12.2 releases 12.2.3 through 12.2.15; earlier or later lines outside this band are not in scope. Limiting factors that reduce real-world risk: the attacker must first obtain valid EBS credentials, the EBS web tier must be network-reachable to the attacker, and no availability impact is possible (data disclosure/tampering only, not service disruption).

Signals point to a genuine, high-priority enterprise risk but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) shows network-reachable, low-complexity, no-user-interaction exploitation requiring only low privileges, which for a widely deployed ERP is a serious exposure. Countervailing factors: there is no EPSS score provided, no POC or exploit code identified, and the CVE is absent from CISA KEV, so there is no evidence of active or automated exploitation yet. Note a data conflict to verify with the vendor: the tag labels this 'Authentication Bypass' (implying no credentials needed), yet the authoritative CVSS vector specifies PR:L (a valid low-privileged account is required) - treat this as an authenticated authorization-bypass unless Oracle clarifies otherwise. No SSVC decision data was supplied. Net: patch on a prioritized cycle given EBS's business-critical role and the high C/I impact, even without confirmed in-the-wild activity.

A user holding any low-privileged Oracle Customer Support account authenticates to the EBS web interface and sends crafted HTTP requests to the Update Service Request function, exploiting missing authorization checks to read and alter Service Request records outside their permitted scope. Because attack complexity is low and no user interaction is required, a single valid low-tier credential (or a compromised one) is enough to reach or tamper with all Customer Support-accessible data. No public exploit code has been identified at time of analysis.