Oracle E-Business Suite EUVD-2026-47332

Exploitation requires network HTTP(S) access to the Oracle E-Business Suite web tier and a valid low-privileged EBS application account (CVSS PR:L) - it is not anonymous/pre-authentication despite the 'Authentication Bypass' tag. The target must be running Oracle HRMS (UK) with the UK Payroll component on EBS versions 12.2.9 through 12.2.15. No user interaction and no elevated privileges are needed (UI:N, AC:L), so any authenticated foothold on the EBS instance that can reach the UK Payroll servlets suffices. Limiting factors: the attacker needs prior credentials, the specific UK Payroll module must be deployed and reachable, and instances that do not expose the EBS web tier to the attacker's network segment are not directly exploitable.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding high confidentiality and integrity impact - a serious combination for an ERP holding payroll and personnel data. The 8.1 base score is credible and the 'easily exploitable' language plus low PR make weaponization plausible. However, key signals are missing: no EPSS score, no POC, and no CISA KEV listing were provided, so there is no evidence of active or automated exploitation at this time. The PR:L requirement is the main limiter - an attacker must already hold a valid (even low-privileged) EBS application account, making this most relevant as an insider or post-compromise authorization-escalation issue rather than a fully anonymous internet-facing takeover. Note a tension: the vendor tag says 'Authentication Bypass' yet the CVSS vector requires PR:L (authenticated), suggesting this is more accurately an authorization/access-control bypass than a true pre-auth bypass - verify intent with Oracle's advisory.

An attacker who holds any low-privileged Oracle EBS application account (for example a self-service employee login or a compromised internal user) sends crafted HTTP requests to the UK Payroll module and, because of the broken authorization check, reads and alters payroll and HR records belonging to other users. No user interaction or high privileges are needed, so a single valid low-level credential is sufficient to exfiltrate or tamper with all HRMS (UK)-accessible data. No public exploit identified at time of analysis.