Oracle E-Business Suite EUVD-2026-47174

The attacker must possess a valid low-privilege account on the Oracle E-Business Suite instance (confirmed by PR:L in the CVSS vector). Network access to the EBS application via HTTP is required (AV:N). The Rapid Implementation component of Oracle HCM Configuration Workbench must be deployed and accessible, which is a standard operational state for EBS HCM customers actively using this configuration tooling. No user interaction is required once the attacker has network connectivity and valid credentials. Exploitation is strictly bounded to confidentiality impact - no write, modify, or destructive capability is indicated by the CVSS vector (I:N/A:N). Limiting factors: the attacker must first obtain authenticated access at any privilege level, which excludes fully unauthenticated remote exploitation; the scope is limited to data accessible within Oracle HCM Configuration Workbench and does not indicate OS-level access, lateral movement to other EBS modules, or cross-system compromise (S:U).

The CVSS 3.1 score of 6.5 (Medium) reflects a network-exploitable, low-complexity flaw requiring only a low-privileged account, with a high confidentiality impact but zero integrity or availability impact. The 'Authentication Bypass' tag combined with PR:L presents a nuanced but consistent picture: the attacker is not entirely unauthenticated, but once authenticated at the lowest privilege tier, can exceed their authorized data scope - effectively an authorization bypass rather than a full authentication bypass. No EPSS score was provided in the input data, limiting probabilistic exploitation forecasting. No CISA KEV listing exists and no public proof-of-concept has been identified, indicating exploitation has not yet been commoditized or broadly observed. Despite the moderate CVSS score, the sensitive nature of HCM data - employee PII, salary, benefits, workforce planning - makes confidentiality loss particularly consequential in regulated industries subject to GDPR, HIPAA, or labor regulations. Risk is operationally real but not immediately critical absent exploitation evidence; organizations should treat this as a standard CPU patching obligation, with elevated urgency for EBS deployments exposed to untrusted networks or shared-access environments.

An attacker holding any low-privilege EBS account - such as a contractor, read-only HR self-service user, or compromised service account - sends crafted HTTP requests to the Rapid Implementation component of Oracle HCM Configuration Workbench. By exploiting the authorization bypass, the attacker retrieves sensitive HCM records (employee compensation, organizational hierarchies, workforce data) far beyond their granted entitlement. No public proof-of-concept has been identified at time of analysis, but the low attack complexity (AC:L) and absence of user interaction requirements mean exploitation demands minimal technical sophistication once an authenticated foothold exists.