Oracle EBS EUVD-2026-47233

Exploitation requires an authenticated low-privilege Oracle E-Business Suite account (CVSS PR:L) with network HTTP access to the EBS web tier hosting the Process Manufacturing Systems / Internal Operations component; no user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker must already possess valid EBS credentials, so this is not remote-unauthenticated despite the vendor 'Authentication Bypass' tag; only EBS 12.2.3-12.2.15 are affected; and impact is confined to data confidentiality and integrity (no availability/denial-of-service, A:N). Exposure is greatest where the EBS instance is internet-facing or where many users hold low-privilege OPM responsibilities.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) describes an easily exploitable, network-reachable flaw needing only a valid low-privilege account and no user interaction, yielding High confidentiality and integrity impact but no availability impact - hence the 8.1 base score rather than critical. No EPSS score, POC, or KEV entry was supplied, so probabilistic and in-the-wild exploitation signals are unavailable; risk is inferred from the vector alone. A notable tension exists between the vendor 'Authentication Bypass' tag and the PR:L metric: a true unauthenticated bypass would warrant PR:N, so the requirement of an existing low-privilege EBS credential is the realistic barrier - verify the exact privilege prerequisite with Oracle. Oracle EBS is a frequent enterprise-attack target, so despite the absence of a public exploit this warrants prompt patching, particularly where OPM users are numerous or externally reachable.

An attacker who holds or phishes any low-privilege Oracle EBS account with network access to the application's HTTP interface sends crafted requests to the Process Manufacturing / Internal Operations functions and, bypassing the intended authorization boundary, reads or alters all OPM-accessible data. No user interaction or elevated privileges are needed and the attack complexity is low, so a single valid credential is sufficient. No public exploit code is currently identified.