Oracle Order Management EUVD-2026-47155

Exploitation requires a valid Oracle E-Business Suite user account with at minimum low-privilege access (PR:L per CVSS) and network connectivity to the EBS application server via HTTP. The targeted subcomponent is Product Diagnostic Tools within Order Management, meaning the EBS deployment must include the Order Management module and this diagnostic interface must be accessible to the attacker's account or role. No user interaction is required beyond the attacker's own actions. Exploitation is limited by the mandatory authentication step - unauthenticated external attackers cannot exploit this directly without first obtaining EBS credentials. The scope change means that while Order Management is the entry point, additional EBS modules on the same platform may be affected. Versions outside the 12.2.3-12.2.15 range are not confirmed affected.

The CVSS 3.1 score of 6.4 is Medium, but the scope change (S:C) elevates practical risk in environments running multiple integrated EBS modules, as a single compromised Order Management endpoint may allow data manipulation across the broader EBS deployment. AV:N/AC:L indicates network-accessible with low complexity, making exploitation straightforward for any attacker who has cleared the PR:L threshold. PR:L confirms a minimum authenticated low-privilege account is required, which limits opportunistic exploitation from anonymous external attackers but remains relevant for insider threat scenarios or environments where EBS accounts are broadly provisioned. No EPSS data was provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread active exploitation at time of analysis. The 'Authentication Bypass' tag introduces ambiguity: the CVSS PR:L rating indicates low-privilege authentication is required to reach the vulnerable endpoint, but the bypass may allow that low-privileged user to access data or functionality beyond their authorization scope. CVSS impacts are limited to C:L and I:L with no availability impact, making this a data integrity and confidentiality concern rather than a service disruption risk. Priority should be elevated for organizations with broad internal EBS user populations or multi-module EBS deployments.

An attacker with a low-privileged Oracle EBS user account (e.g., a basic Order Management operator) sends crafted HTTP requests to the Product Diagnostic Tools endpoint, leveraging the authentication bypass to access or modify data beyond their authorized scope. Because the vulnerability carries a scope change, the attacker may also read or alter data in adjacent EBS modules accessible through the shared application context. No public exploit code has been identified, but the low attack complexity means that any attacker who reverse-engineers the authorization flaw from Oracle patch diffs could construct a working exploit.