Oracle MES EUVD-2026-47312

Exploitation requires that a legitimate Oracle MES for Process Manufacturing / EBS user (someone other than the attacker) be induced to interact with an attacker-supplied HTTP request - clicking a crafted link or loading a malicious page - while the MES web tier is reachable over the network (AV:N, PR:N, UI:R). No attacker credentials are needed. The limiting factors that reduce real-world risk are: the mandatory human interaction, the need for the target instance to run affected versions 12.2.3-12.2.15, and network reachability of the EBS web tier; deployments that are internal-only, well-segmented, and where users avoid untrusted links are substantially harder to hit.

The signals point to a real but interaction-gated risk rather than a wormable emergency. CVSS 8.2 is driven by AV:N/AC:L/PR:N and the scope change (S:C), but the score is materially tempered by UI:R - a person other than the attacker must be induced to act, so exploitation is not fully automatable. No EPSS score was supplied, there is no POC in the provided data, and it is not in CISA KEV, so there is no evidence of active or widespread exploitation; this reads as a phishing/social-engineering-dependent flaw against internal EBS users. Confidentiality impact is High (full read of MES-accessible data) but integrity is only Low (some insert/update/delete) and availability is None. Note a mild tension: the vendor tag says 'Authentication Bypass' while the vector shows UI:R and no direct auth bypass metric - this is best read as session-context abuse via the victim, not a credential-less admin takeover; verify exact mechanism with Oracle. Priority is high for internet-exposed or large multi-user EBS installs, moderate for tightly segmented internal deployments.

An attacker crafts a malicious link or form targeting an Oracle MES for Process Manufacturing endpoint and emails it to a plant operator or EBS user who is already logged in. When the victim opens it, attacker-controlled content executes in their authenticated session, exfiltrating sensitive MES data and performing limited unauthorized writes. No public exploit code is identified at time of analysis, and the mandatory human interaction (UI:R) makes this a targeted, social-engineering-driven attack rather than a mass-automated one.