Oracle Treasury EUVD-2026-47216

Exploitation requires a valid low-privileged Oracle E-Business Suite account (CVSS PR:L) with HTTP network access to the EBS web tier hosting the Oracle Treasury Internal Operations component, on affected versions 12.2.3-12.2.15. No end-user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker must already be authenticated to EBS (not fully anonymous, despite the 'Authentication Bypass' tag), the target must be a supported 12.2.x EBS deployment with Treasury in use, and impact is confined to confidentiality and integrity of Treasury-accessible data with no availability/DoS effect.

The signals point to a genuine but not emergency-tier priority. CVSS 3.1 is 8.1 with AV:N/AC:L/PR:L/UI:N and C:H/I:H - network-reachable, low complexity, no user interaction, and only a low-privileged account required, which Oracle explicitly calls 'easily exploitable.' However, A:N means no availability/denial-of-service impact, and the requirement for a valid EBS account (PR:L) meaningfully narrows the attacker population versus a fully unauthenticated bug. No EPSS score was provided, the CVE is NOT in CISA KEV, and no POC is referenced, so there is no evidence of active or automated exploitation - this is a patch-on-normal-cycle-but-promptly issue for EBS operators, weighted up because Treasury handles sensitive financial data. Note the conflict to verify: the vendor tag says 'Authentication Bypass' while the CVSS vector says PR:L (authenticated); treat auth requirements as low-privileged-authenticated per the vector, not unauthenticated.

An attacker who holds any low-privileged EBS account (for example a limited internal user or a compromised employee credential) sends crafted HTTP requests to the Treasury Internal Operations functionality and, due to missing authorization checks, reads or tampers with financial data across all Treasury-accessible records. Because AC:L and UI:N, the request succeeds reliably without special timing or victim interaction; no public POC is currently referenced.