EUVD-2026-47223
GHSA-pjcm-7mv5-f9w6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Oracle Scripting HTTP endpoint
-
DeliverySend crafted pre-auth HTTP request
-
ExploitSatisfy high-complexity trigger condition
-
ExecutionBypass access controls in Scripting module
-
ImpactTake over Oracle Scripting (read/modify/deny)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Reachable over HTTP to the Oracle E-Business Suite web tier hosting the Oracle Scripting 'Internal Operations' component, versions 12.2.3-12.2.15; no authentication (PR:N) and no user interaction (UI:N) are required. Exploitation is materially LIMITED by high attack complexity (AC:H): the attacker must overcome conditions they do not fully control - likely specific timing, environmental state, or a race/configuration-dependent path - so reliable exploitation is difficult and not guaranteed on a first attempt. Deployments that do not expose the Scripting module to the network, or that have it de-registered/unused, are not practically exploitable. |
| Impact | The signals are mixed. CVSS 3.1 rates this 8.1 (High) with AV:N/PR:N/UI:N - network-reachable, unauthenticated, no user interaction - which normally flags urgent patching, but AC:H materially lowers real-world exploitability because success depends on conditions outside the attacker's control (timing, environmental state, or a non-trivial exploit path). No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified here. The flaw is NOT in CISA KEV and no POC is referenced, so there is no evidence of active or imminent exploitation. Net: a genuinely high-impact, pre-auth vulnerability in an enterprise-critical product that warrants prompt patching, but the high complexity and absence of a public exploit make it a priority-two rather than drop-everything item versus a comparable AC:L bug. Note the conflict between the vendor 'Information Disclosure' tag and the C:H/I:H/A:H 'takeover' language - treat the CVSS vector as authoritative and verify scope with Oracle. |
| Exploit ScenarioDerived | A remote attacker with no credentials sends specially crafted HTTP requests to an internet- or intranet-exposed Oracle Scripting endpoint and, by satisfying the non-trivial preconditions implied by AC:H, chains the flaw to gain full control of the Scripting module - reading, altering, or destroying its data and functions. No public POC or exploit code is identified at time of analysis, so an attacker would need to independently develop the exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Full takeover of Oracle Scripting, the scripted-interaction module of Oracle E-Business Suite (Internal Operations component), is possible by a remote unauthenticated attacker over HTTP in supported releases 12.2.3 through 12.2.15. Because the CVSS vector carries high confidentiality, integrity, and availability impact (8.1), a successful attack yields complete compromise of the module rather than mere data exposure, though the high attack complexity (AC:H) means exploitation is not trivial. There is no public exploit identified at time of analysis and the flaw is not on the CISA KEV list.
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); patch available per vendor advisory, though no discrete fix version string was published in the available data, so consult the CPU patch matrix for the exact patch number matching your 12.2.x level. Oracle CPUs are cumulative, so install the latest EBS 12.2 CPU rather than an isolated hotfix. Because the vector is network/HTTP and pre-auth, until patching completes restrict external and untrusted-network reachability of the Oracle Scripting URLs - front them behind a VPN or IP allowlist and use the Oracle EBS URL Firewall / DMZ configuration to expose only the specific responsibilities and modules required; de-registering or disabling the Scripting module if it is unused removes the surface entirely. Trade-off: URL Firewall and network restrictions can break legitimate remote agent/call-center access and must be scoped against your allowed servlet list, so test before enforcing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Scripting is a component of Oracle E-Business Suite (EBS), Oracle's on-premise ERP/CRM stack, used to build and run guided call-center and agent interaction scripts; it is exposed through the EBS web tier over HTTP. The affected surface is the 'Internal Operations' component of the 12.2.x EBS release train, which runs on the Oracle Application Server / WebLogic middleware over a backing Oracle Database. No CWE was assigned by the vendor, so the precise root-cause class is not published; the Oracle-supplied 'Information Disclosure' tag understates the disclosed impact, since the CVSS vector asserts full C/I/A compromise ('takeover'), pointing toward an authentication/authorization bypass or injection reachable pre-auth rather than a pure read primitive.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
HTTP-reachable and pre-auth (AV:N/PR:N/UI:N); AC:H reflects the vendor's 'difficult to exploit' framing; 'takeover' justifies C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in takeover of Oracle Scripting. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle E-Business Suite versions 12.2.3-12.2.15 contain CVE-2026-60979, which allows unauthenticated remote attackers to gain complete control of the Scripting module over HTTP, potentially compromising internal operations. Organizations running affected versions face risk of full module takeover with no patch currently available from Oracle. Immediate network containment and mitigation planning is required to reduce organizational exposure.
No vendor-released patch identified at time of analysis. Interim mitigations include: firewall-based network segmentation restricting HTTP access to the Scripting module to authorized administrative networks only; operational disabling of the Scripting module if business requirements permit; enhanced logging and alerting on all module access attempts; and isolation of affected systems to limit blast radius in the event of successful compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB