Oracle E-Business Suite EUVD-2026-47229

Exploitation requires an authenticated low-privileged Oracle E-Business Suite account (PR:L) with network HTTP access to the Oracle Project Portfolio Analysis module's Internal Operations component on an affected 12.2.3-12.2.15 instance; no user interaction is needed (UI:N). The key limiting factor is the High attack complexity (AC:H): Oracle rates this 'difficult to exploit,' implying conditions outside the attacker's direct control - such as specific configuration, data state, or timing - must be met for a successful attack, which materially constrains real-world exploitability despite the network vector. The requirement to first hold valid EBS credentials is itself a significant barrier for externally facing deployments.

The signals are mixed and should temper urgency. The CVSS 3.1 base score of 7.5 is driven by full C/I/A impact, but the vector explicitly rates Attack Complexity as High (AC:H) and requires low privileges (PR:L), meaning the attacker must already hold a valid EBS account and overcome non-trivial conditions to succeed. There is no EPSS score, no SSVC decision data, no CISA KEV listing, and no evidence of public exploit code in the provided intelligence, so there is no indication of active or automatable exploitation. The 'takeover' wording from Oracle conflicts somewhat with the vendor-supplied 'Information Disclosure' tag - verify the true impact against Oracle's July 2026 CPU. On balance this is a genuine but not emergency-tier issue: high potential impact offset by required authentication and high exploit complexity, placing it in the standard patch-cycle priority band rather than break-glass remediation, though internet-exposed EBS instances warrant faster attention.

An attacker who has obtained or been granted a low-privilege Oracle E-Business Suite account sends crafted HTTP requests to the Project Portfolio Analysis / Internal Operations functionality of an internet-reachable or internally accessible EBS 12.2.x instance. By exploiting the flaw under the specific conditions required (reflected in the High attack complexity), the attacker escalates to full compromise of the module, gaining the ability to read, alter, and destroy its data. No public proof-of-concept is available at time of analysis, so this reflects a plausible rather than demonstrated attack.