Oracle Order Management EUVD-2026-47326

Exploitation requires an authenticated high-privileged EBS user (CVSS PR:H) with HTTP network access to the Oracle Order Management Product Diagnostic Tools component in a version between 12.2.3 and 12.2.15; the attack is low-complexity and needs no user interaction (AC:L/UI:N). The key limiting factors are the high privilege prerequisite - the attacker must already hold an elevated EBS role/responsibility, not merely a basic user account - and the version constraint to the affected 12.2.x range; there is no unauthenticated path indicated by the CVSS vector.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) shows a network-reachable, low-complexity attack that nonetheless requires high privileges (PR:H) and no user interaction, yielding full CIA impact but unchanged scope. The PR:H requirement is the dominant limiting factor: the attacker must already hold an elevated EBS account, which lowers real-world risk relative to an unauthenticated RCE despite the 'easily exploitable' phrasing. No EPSS score, no KEV listing, and no POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; no SSVC decision data was supplied. Note a signal conflict: the supplied tags label this 'Information Disclosure,' yet the CVSS vector and Oracle's description indicate full takeover (C:H/I:H/A:H), so the tag understates the impact and the CVSS/description should be treated as authoritative. Overall this is a genuine but privilege-gated priority - high impact, but not a mass-exploitation candidate absent broader access.

An attacker who has obtained or been granted a high-privileged Oracle E-Business Suite account (for example a compromised administrator or a malicious insider) sends crafted HTTP requests to the Product Diagnostic Tools component of Order Management. Because the attack complexity is low and no user interaction is required, the attacker leverages the flaw to gain full control of the Order Management module, reading and altering order data and disrupting availability. No public proof-of-concept was identified at time of analysis.