Oracle Service Fulfillment Manager EUVD-2026-47203

Exploitation requires an authenticated, high-privileged Oracle E-Business Suite account (CVSS PR:H) with HTTP network access to the Oracle Service Fulfillment Manager Fulfillment Engine component, on EBS versions 12.2.3 through 12.2.15; no user interaction and low attack complexity are needed. The key limiting factors are the high-privilege prerequisite (the attacker must already hold elevated EBS responsibilities, not merely any authenticated session) and reachability of the EBS web tier over HTTP. Note the unresolved conflict: the vendor 'Authentication Bypass' tag suggests privileges might be circumvented, but the official CVSS vector states PR:H - treat the high-privilege requirement as the assessed condition until Oracle clarifies.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N, base 8.7) describes a network-reachable, low-complexity attack requiring high privileges and no user interaction, yielding full confidentiality and integrity loss but no availability impact, with scope change amplifying severity. The dominant limiting factor is PR:H - the attacker must already be a high-privileged EBS user, which narrows the realistic threat to insiders or adversaries who have already compromised a privileged account. No EPSS score, SSVC decision data, or CWE were provided, so automated-exploitation likelihood cannot be quantified. There is no evidence of active exploitation (not in CISA KEV) and no public POC, making this a normal-cycle patch priority for internet-exposed or multi-tenant EBS deployments rather than an emergency. Note the conflict: the 'Authentication Bypass' tag would imply lower privilege requirements, but the vendor's own CVSS vector states PR:H - verify the actual privilege prerequisite with Oracle before deprioritizing on the high-privilege assumption.

An attacker who has obtained a high-privileged Oracle E-Business Suite account - for example a rogue insider or an adversary who phished a fulfillment administrator - sends crafted HTTP requests to the Service Fulfillment Manager's Fulfillment Engine. Because of the scope change, the attacker not only reads and tampers with all Service Fulfillment Manager data but can also impact integrated EBS components, altering or deleting critical order and customer data. No public exploit code is currently available.