EUVD-2026-47206
GHSA-p8qm-6w8x-w97w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged OLM user
-
DeliveryCraft malicious HTTP request/link
-
ExploitLure victim to interact (UI:R)
-
ExecutionAction executes in victim context
-
ImpactRead, modify, or delete critical OLM data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires: (1) the attacker holds a valid low-privileged account on the target Oracle Learning Management / EBS instance (CVSS PR:L - not unauthenticated); (2) network/HTTP reachability to the OLM web interface (AV:N); and (3) human interaction from a person other than the attacker (CVSS UI:R) - a victim must be induced to interact for the attack to succeed. Affected deployments are OLM within EBS versions 12.2.3-12.2.15. The dependency on both prior authentication and victim interaction is the primary limiting factor that constrains realistic exploitation despite the network attack vector; there is no availability impact (A:N). |
| Impact | The signals are moderate and largely self-consistent. CVSS 3.1 is 7.3 (High) with AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N: network-reachable and low-complexity, but it requires both some privileges (PR:L, i.e. an authenticated low-privileged account) and human interaction from a victim other than the attacker (UI:R), which meaningfully lowers real-world exploitability versus a fully unauthenticated drive-by. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. It is not in CISA KEV and no POC is referenced, so this is not confirmed active exploitation. The 'Authentication Bypass' tag is somewhat in tension with the PR:L vector (which implies an attacker already holds an account); this may reflect that the flaw lets a low-privileged account act beyond its authorization boundary - verify the precise mechanism against Oracle's CPU July 2026 advisory. Net: a real but not top-tier emergency priority - patch on Oracle's normal critical-patch cadence, prioritized above availability-only issues because it exposes and mutates critical data. |
| Exploit ScenarioDerived | An attacker who holds a low-privileged Oracle Learning Management account crafts a malicious HTTP action and induces a higher-context OLM user to interact with it (for example by opening a link or performing a triggered in-app action), causing operations to execute in the victim's context. This yields unauthorized read and modification/deletion of critical OLM data. No public POC is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Data compromise in Oracle Learning Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read, create, delete, or modify all data accessible to the application after luring a victim into interacting. Rated CVSS 3.1 7.3 (High) with full confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the required user interaction moderates raw exploitability.
RemediationAI
Apply the fixes delivered in Oracle's Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships EBS security fixes as bundled CPU patches per release level rather than as a single named version, so identify and apply the OLM/EBS 12.2.x patch listed in that CPU for your exact patchset - no discrete standalone fix-version string was provided in this data. Because exploitation needs an authenticated low-privileged user plus victim interaction, interim compensating controls while you schedule the CPU include: restrict OLM access to trusted internal networks or VPN and remove any internet exposure of the EBS web tier (trade-off: reduces reach for legitimate remote/external learners); tighten OLM responsibilities/roles to the least privilege needed and audit low-privileged accounts (trade-off: administrative overhead and possible user friction); and enforce user-awareness controls to reduce the likelihood victims act on attacker-supplied links/requests. Do not rely on these as a permanent substitute for the CPU patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Learning Management (OLM) is an enterprise learning/training module within Oracle E-Business Suite (EBS), a large ERP platform accessed over HTTP through a browser-based front end. The affected component is 'Internal Operations,' and Oracle's own tagging associates this issue with an authentication bypass class of weakness (no CWE was supplied in the feed, so the exact weakness type is not formally classified). The CVSS vector (AV:N/AC:L/PR:L/UI:R) indicates a web-facing flaw reachable over HTTP that a low-privileged EBS user can trigger, with the twist that the payload lands against another user who must interact - a pattern consistent with cross-user request handling or session/authorization abuse in the web tier rather than a memory-safety bug. No CPE strings were provided in this feed, so exact affected configurations are drawn from the EUVD/Oracle version range.
Know when Learning Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Network HTTP reachable and low-complexity, but needs an authenticated low-privileged account (PR:L) and a separate victim's interaction (UI:R); high confidentiality/integrity, no availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Learning Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Learning Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Learning Management accessible data. CVSS 3.1 Base Score 7.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle Learning Management in E-Business Suite versions 12.2.3-12.2.15 contains a vulnerability allowing authenticated users with low privileges to compromise all accessible organizational data through social engineering. This creates significant risk to learning records, user information, and operational data for organizations using affected versions, particularly where user training and regular system interaction is common.
In the absence of a vendor-released patch, implement principle of least privilege by auditing and restricting data access permissions for low-privileged accounts in Oracle Learning Management; disable or restrict bulk export and data manipulation features; implement application activity logging and monitoring for unauthorized data access attempts; provide security awareness training to reduce susceptibility to social engineering tactics; consider network access controls limiting system connectivity to necessary internal users only.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Learning Management
View allVulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: OTA Training Activities).
Data compromise in Oracle Learning Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 t
Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Setup). Rated high severi
Unauthorized data disclosure in Oracle Learning Management (E-Business Suite) versions 12.2.3 through 12.2.15 allows a l
Unauthenticated remote access to Oracle Learning Management (E-Business Suite versions 12.2.3 through 12.2.15) enables a
Import and Export component exploitation in Oracle Learning Management (Oracle E-Business Suite 12.2.3-12.2.15) allows a
Exploit-DB