Oracle Advanced Pricing EUVD-2026-47158

Exploitation requires an authenticated Oracle E-Business Suite session at low privilege (CVSS PR:L) with network HTTP access to the EBS application tier hosting the Oracle Advanced Pricing 'Pricing Installation' component, on a 12.2.3-12.2.15 deployment. No end-user interaction is needed (UI:N) and attack complexity is low (AC:L). The limiting factors are: the attacker must already possess or obtain a valid low-privilege EBS account (this is NOT pre-authentication despite the 'Authentication Bypass' tag), the target must be a supported EBS 12.2.x release with the Advanced Pricing module installed and web-reachable, and impact is bounded to Advanced Pricing data (scope unchanged), not the wider EBS suite or host operating system.

The signals are moderately consistent. CVSS 3.1 rates this 7.1 High, driven by AV:N (network/HTTP), AC:L (low complexity), PR:L (a valid low-privilege account is required), UI:N (no user interaction), C:H (full read of module data) and I:L (partial write); availability is untouched (A:N). Oracle labels it 'easily exploitable,' aligning with AC:L. However, PR:L is a meaningful gate: this is not remotely unauthenticated, so the realistic threat is a malicious or compromised low-tier EBS user pivoting to broader pricing data. There is no EPSS score, no SSVC decision, no KEV listing, and no known POC in the provided data, so exploitation probability cannot be quantified and there is no evidence of active exploitation. Note a tension worth verifying: the 'Authentication Bypass' tag implies bypassing authentication, yet the CVSS vector requires PR:L (an authenticated low-privilege account) - treat the tag as an authorization/access-bypass within an authenticated session rather than pre-auth access, and confirm with Oracle. Overall this is a genuine High-priority patch for EBS operators because of the sensitive pricing/commercial data exposed, but the mandatory low-privilege foothold lowers mass-exploitation likelihood relative to a pre-auth flaw.

A malicious insider or an attacker who has phished or otherwise obtained a low-privilege Oracle EBS application account sends crafted HTTP requests to the Advanced Pricing / Pricing Installation interface, and by abusing the access-control weakness reads confidential pricing, discount, and modifier data across the module and alters some of it. No user interaction or elevated privileges are needed beyond the initial low-tier login, and no public POC is currently identified, so this would require attacker-developed tooling.