Oracle E-Business Suite EUVD-2026-47251

Exploitation requires network access to the Oracle E-Business Suite web tier over HTTP and, per the CVSS vector PR:L, a valid low-privileged EBS account authenticated to reach the Oracle Process Manufacturing Product Development 'Internal Operations' component; the target must be running an affected version in the 12.2.3-12.2.15 range with the OPM Product Development module deployed and in use. Limiting factors: the OPM module is only present in process-manufacturing EBS deployments (not every EBS install), and a low-privilege credential is needed under the CVSS metrics. Note a data conflict - Oracle's 'Authentication Bypass' tag suggests authentication might be circumventable, which would remove the credential prerequisite; this could not be confirmed from the provided data and should be verified with Oracle.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1) signals genuinely attractive attack economics: network-reachable over HTTP, low complexity, no user interaction, and only a single low-privileged account required - combined with Oracle's own 'easily exploitable' language. This points to real priority for organizations running affected OPM versions, especially where EBS is internet-facing. However, mitigating real-world-risk signals are missing: this CVE is not in CISA KEV (no confirmed active exploitation), no public POC has been identified, and no EPSS score or SSVC decision data was provided, so exploitation probability cannot be quantified. The vendor tag 'Authentication Bypass' contradicts the PR:L (authenticated, low-privilege) metric - verify with Oracle whether unauthenticated access is possible, as that would materially raise risk. Availability is unaffected (A:N), so this is a data-confidentiality/integrity issue, not a denial-of-service concern.

An attacker who has obtained or been granted a low-privilege EBS user account sends crafted HTTP requests to the Oracle Process Manufacturing Product Development Internal Operations endpoints, leveraging the flaw to read and tamper with formulas, recipes, and other module data beyond their intended authorization. Because attack complexity is low and no user interaction is needed, a single valid low-privilege credential (or, if the vendor 'Authentication Bypass' tag proves accurate, potentially no credential) is sufficient. No public exploit code has been identified at time of analysis.