EUVD-2026-47222
GHSA-w674-wjqx-2vg9
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Network-accessible via HTTP with low complexity per vendor; PR:H retained per description though 'Authentication Bypass' tag introduces unresolved ambiguity; A:N as no availability impact is described.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Scripting accessible data as well as unauthorized access to critical data or complete access to all Oracle Scripting accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).
AnalysisAI
Oracle Scripting within E-Business Suite (versions 12.2.3 through 12.2.15) allows a high-privileged attacker with HTTP network access to fully compromise data confidentiality and integrity in the Internal Operations component. Despite the PR:H CVSS rating, the 'Authentication Bypass' tag raises concern that effective access controls may be circumventable, potentially lowering the real exploitation barrier below what the score implies. No public exploit or CISA KEV listing has been identified at time of analysis, but the July 2026 Oracle CPU advisory confirms the issue and remediation is available.
Technical ContextAI
Oracle Scripting is a module within Oracle E-Business Suite (EBS) used to build and deploy survey and data-collection workflows in enterprise ERP environments. The affected component, 'Internal Operations,' points to backend processing logic rather than a user-facing interface, suggesting the flaw exists in server-side request handling or privilege enforcement within that subsystem. No CWE was specified by the reporter, but the 'Authentication Bypass' tag indicates the root cause likely falls into improper access control or broken authentication categories (analogous to CWE-287 or CWE-862). The CVSS vector confirms exploitation occurs over the network via HTTP with low attack complexity, consistent with a programmatic flaw in how the Internal Operations endpoint validates caller identity or privilege level. Affected versions span 12.2.3 through 12.2.15, covering a broad multi-year release window of Oracle EBS.
RemediationAI
Apply the Oracle Critical Patch Update for July 2026, documented at https://www.oracle.com/security-alerts/cpujul2026.html, which contains the specific patch instructions and fix details for Oracle E-Business Suite. An exact patched version number is not independently confirmed from the available reference data beyond the CPU advisory itself - consult the Oracle advisory directly for the target patch level. As a compensating control prior to patching, restrict network-layer access to the Oracle Scripting Internal Operations HTTP endpoint to only trusted administrative subnets using firewall or reverse-proxy ACLs; note this does not eliminate the vulnerability but raises the attacker's access bar. Additionally, audit and minimize the set of accounts holding high-privilege roles within Oracle Scripting, and review audit logs for anomalous Internal Operations activity. Disabling the Oracle Scripting module entirely is a high-impact workaround if the feature is not actively in use.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today