Oracle E-Business Suite EUVD-2026-47238

Exploitation requires network HTTP access to the Oracle E-Business Suite web tier and a valid low-privilege authenticated EBS account (CVSS PR:L confirms authentication is required - this is not unauthenticated). The target must be running Oracle Process Manufacturing Systems (the OPM Internal Operations component) on EBS versions 12.2.3 through 12.2.15. Limiting factors: the required valid credential means a purely anonymous internet attacker cannot exploit it directly, and only environments that actually deploy the OPM module and expose the EBS web tier to the attacker's network are at risk; with no user interaction and low complexity, once those preconditions are met exploitation is straightforward.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates a genuinely serious, easily exploitable flaw: remotely reachable over HTTP, low attack complexity, no user interaction, and full CIA compromise - but it requires authentication (PR:L), so a valid low-privilege EBS account is a prerequisite. No EPSS score was provided, no POC is identified, and it is not in CISA KEV, so there is no current evidence of active or automated exploitation despite the high base score. This tempers the raw number: it is a high-priority patch for any organization running EBS OPM (an ERP takeover is business-critical), but the authentication requirement and absence of public exploit code suggest it is not yet an opportunistic mass-exploitation target. Oracle's 'easily exploitable' language combined with the low PR is the main reason to prioritize patching. EPSS data is missing and should be verified directly before final triage.

An attacker who has obtained or been granted a low-privilege Oracle E-Business Suite account (for example a limited internal user, contractor, or a phished credential) sends crafted HTTP requests to the Process Manufacturing Systems Internal Operations component and abuses the flaw to escalate to full control of the module, reading and altering manufacturing data and disrupting operations. Given AV:N/AC:L/UI:N, the requests can come from anywhere the EBS web tier is reachable with no special timing or victim interaction; no public POC has been identified at time of analysis.