Oracle E-Business Suite EUVD-2026-47189

Requires a valid low-privileged Oracle E-Business Suite account with HTTP network reachability to the Oracle Capacity (Internal Operations) application tier - exploitation is NOT fully unauthenticated (CVSS PR:L). Affected deployments must run EBS 12.2.3 through 12.2.15. No user interaction is required (UI:N) and attack complexity is low (AC:L), so any authenticated low-tier user who can reach the Capacity HTTP endpoints meets the prerequisites. Limiting factors: the credential requirement narrows the attacker set to insiders or those with a compromised account, and network exposure of the Capacity module (typically internal rather than internet-facing) further constrains reach.

The CVSS 3.1 base score is 7.7 (High), driven by network attack vector (AV:N), low complexity (AC:L), and a scope change (S:C) that amplifies impact into adjacent products, offset by the requirement for a low-privileged account (PR:L) and confidentiality-only impact (C:H/I:N/A:N). This is a data-exposure issue, not code execution or availability loss, so the practical risk is unauthorized reading of sensitive planning/operations data rather than system takeover. No EPSS score, KEV listing, or public POC was provided, so exploitation probability cannot be quantified and there is no evidence of active exploitation. The PR:L requirement is a meaningful limiter - an attacker needs valid (even low-level) EBS credentials - but EBS deployments often have many internal users, making the low bar realistically reachable by insiders or via compromised low-tier accounts. Net: a genuine priority for EBS operators handling sensitive data, but weighted toward insider/credentialed-attacker threat models rather than fully unauthenticated internet-wide exploitation.

A low-privileged internal EBS user (or an attacker who has phished or brute-forced a low-tier account) sends crafted HTTP requests to the Oracle Capacity Internal Operations endpoints and bypasses authorization checks to read planning and operational data they should not see. Owing to the scope change, the same access can expose data belonging to other EBS products sharing the security context. No public exploit code has been identified, so this would currently require independent research to weaponize.