Oracle E-Business Suite EUVD-2026-47228

Exploitation requires an authenticated Oracle E-Business Suite session at low privilege (CVSS PR:L) with network HTTP access to the Project Portfolio Analysis module (Internal Operations component) on an EBS 12.2.3-12.2.15 instance; no user interaction and no administrative rights are needed (UI:N, AC:L). The primary limiting factor is that the attacker must first possess valid low-privileged credentials or a foothold account on the EBS instance - it is not exploitable by a fully anonymous, unauthenticated attacker despite the 'Authentication Bypass' tag, which conflicts with the PR:L vector. Exposure is further limited to organizations running the affected EBS 12.2.x versions with the Project Portfolio Analysis module deployed and its HTTP endpoints reachable by the attacker.

Signals are mixed and should be weighed carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, base 7.1) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with the primary damage being data integrity (I:H) plus limited data disclosure (C:L) and no availability impact. Oracle labels it 'easily exploitable,' which aligns with the AC:L/PR:L metrics. However, no EPSS score was provided, there is no POC evidence, and it is not in CISA KEV, so real-world exploitation likelihood is presently unquantified and no active exploitation is confirmed. One conflict to verify: the intelligence Tags include 'Authentication Bypass,' yet the official CVSS vector specifies PR:L (an authenticated, low-privileged attacker) rather than PR:N - the vector, being Oracle's authoritative rating, should take precedence, and the 'Authentication Bypass' tag appears to be an inaccurate generic label. Net assessment: a genuine, patch-worthy integrity risk for internet- or intranet-exposed EBS instances where low-privileged accounts are common, but not an emergency mass-exploitation scenario on current evidence.

An attacker who holds or obtains any low-privileged Oracle EBS application account sends crafted HTTP requests to the Project Portfolio Analysis functionality and, exploiting insufficient authorization checks, performs create, delete, or modify operations on critical project data they should not control while also reading a subset of otherwise-restricted data. No user interaction or elevated privileges are needed, and no public exploit code has been identified at time of analysis.