Oracle E-Business Suite EUVD-2026-47163

No special conditions - remote unauthenticated (PR:N) exploitation over HTTP against supported Oracle E-Business Suite versions 12.2.3-12.2.15 running the Oracle Work in Process module with the Internal Operations component reachable. The concrete prerequisite is network HTTP access to the EBS web tier hosting WIP; no credentials, no user interaction, and low complexity are required per the CVSS vector. The primary limiting factors are deployment-based rather than technical: the target must be running an affected 12.2.x version with the WIP module deployed and its HTTP endpoint reachable by the attacker, so instances confined to internal networks or behind a properly configured EBS URL firewall/DMZ are meaningfully harder to reach.

The signals are strongly consistent for high priority: CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical) means remote, unauthenticated, low-complexity exploitation with total compromise, and Oracle explicitly labels it 'easily exploitable' - an indicator Oracle reserves for the most weaponizable EBS bugs. Countervailing signals: no EPSS score, POC status, or SSVC decision data were provided, it is NOT in CISA KEV, and no public exploit was identified at time of analysis, so active exploitation is unconfirmed. One inconsistency to flag: the intelligence tag says 'Information Disclosure,' but the CVSS vector and Oracle's own wording ('takeover,' C:H/I:H/A:H) indicate full compromise well beyond disclosure - the CVSS/description should be trusted over the tag, but verify the exact impact with Oracle. Overall this is a genuine priority (unauthenticated internet-facing EBS RCE-class bugs are historically exploited soon after CPU release), not a high-CVSS-but-low-real-risk case, with the main uncertainty being how many affected instances are internet-exposed versus internal.

An attacker who can reach the Oracle EBS web tier over HTTP sends a crafted request to the vulnerable Work in Process / Internal Operations endpoint without any credentials or user interaction, exploiting the low-complexity flaw to gain control of the WIP application and its data. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with full CIA impact, a single unauthenticated HTTP request can lead to takeover; no public POC has been identified at time of analysis, but internet-exposed EBS instances would be immediately at risk once one emerges.