What is the CVSS score of EUVD-2026-47334?

EUVD-2026-47334 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

How to fix or mitigate EUVD-2026-47334?

Within 24 hours: inventory all Oracle E-Business Suite instances, confirm which run versions 12.2.3 through 12.2.15, and identify all downstream systems and business processes that depend on Configure to Order data. Within 7 days: implement access controls restricting Configure to Order functionality to essential authenticated users only, enable comprehensive audit logging for all data access and exports, and establish 24/7 monitoring for anomalous data retrieval patterns. Within 30 days: engage Oracle support to obtain emergency patch information or alternative mitigation strategies, and develop a remediation roadmap that may include version upgrades or architectural changes to reduce exposure.

Oracle E-Business Suite EUVD-2026-47334

| CVE-2026-61125 HIGH

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-c2xw-cg5f-j76x

Authentication Bypass Information Disclosure Oracle E Business Suite

7.7

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate with low-privilege EBS account
Delivery

Reach Supply to Order Workbench over HTTP
Exploit

Send crafted authorization-bypassing request
Execution

Read unauthorized Configure to Order data
Impact

Pivot via scope change to additional Oracle products

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires network HTTP access to the Oracle E-Business Suite web tier and a low-privileged authenticated EBS application account (CVSS PR:L), targeting the Supply to Order Workbench component of Oracle Configure to Order on versions 12.2.3-12.2.15; no user interaction and no high privileges are needed (UI:N, AC:L). Limiting factors: the attacker must already possess valid low-privilege credentials and must be able to reach the CTO/EBS HTTP endpoints, so deployments that are not internet-exposed or that tightly restrict application-account provisioning materially reduce exposure. Note that the community 'Authentication Bypass' tag suggests a weaker auth prerequisite than PR:L implies - this conflict should be confirmed against Oracle's advisory.
Impact	The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) describes a network-reachable, low-complexity, single-privilege attack requiring no user interaction, with high confidentiality impact but zero integrity or availability impact - a data-exposure issue rather than a takeover or destruction issue. Oracle's own text ('easily exploitable', 'low privileged attacker') reinforces low attack complexity and a low authentication bar, which is meaningful because in large EBS deployments low-privileged application accounts are common and sometimes broadly provisioned. However, no EPSS score, no POC, and no CISA KEV entry are present in the provided data, so there is no evidence of active or automated exploitation at this time; real-world urgency is driven by the sensitivity of ERP data and the scope change rather than by observed attacks. The community 'Authentication Bypass' tag appears to conflict with the vendor CVSS PR:L (which requires some privilege), so the exact authentication prerequisite should be verified against Oracle's advisory before treating it as fully pre-authentication.
Exploit ScenarioDerived	An attacker who holds any low-privileged Oracle E-Business Suite application account (or obtains one via phishing or credential reuse) sends crafted HTTP requests to the Supply to Order Workbench in the Configure to Order module and retrieves order, supply, and related business data they are not authorized to see. Because of the scope change, the same access can expose data belonging to other integrated EBS products. No public POC is available at time of analysis, but the low complexity and no-user-interaction profile make exploitation straightforward for anyone with valid low-tier credentials.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Unauthorized data disclosure in Oracle Configure to Order (Supply to Order Workbench component) of Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read all data accessible to the application and, because of a scope change, to impact additional Oracle products beyond Configure to Order. Oracle rates it CVSS 3.1 7.7 with confidentiality-only impact and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it was reported through Oracle's own security alert channel for the July 2026 Critical Patch Update.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update per the advisory at https://www.oracle.com/security-alerts/cpujul2026.html; the CPU is the vendor-released patch mechanism for EBS 12.2.x and is the primary remediation (Patch available per vendor advisory - an exact standalone fix version is not enumerated in the provided data, so identify the specific CTO patch number from the CPU matrix for your 12.2.x level). As compensating controls until patched, restrict network access to the E-Business Suite web tier and specifically to the Configure to Order / Supply to Order Workbench URLs so only trusted internal users reach them (trade-off: may block legitimate remote or partner CTO users); tighten EBS responsibility and function-security grants so low-privileged accounts cannot reach the Supply to Order Workbench (trade-off: requires responsibility-matrix review and may disrupt some order-management workflows); and place the EBS front end behind a reverse proxy or WAF with monitoring on the affected endpoints (trade-off: rules must be tuned to avoid breaking OA Framework requests). Because impact is confidentiality-only, prioritize protecting and auditing access to sensitive order/supply data.

Affected VersionsENISA

Oracle Configure to Order 12.2.3 ≤12.2.15

Affected Packages

euvd oracle_configure_to_order no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle Configure to Order (CTO) is a manufacturing/order-management module within the Oracle E-Business Suite ERP platform, and the flaw resides specifically in its Supply to Order Workbench component, which is exposed over HTTP as part of the EBS web tier (typically Oracle Application Server / WebLogic front-ending the E-Business Suite forms and OA Framework pages). The vendor did not assign a CWE (CWE: N/A), but the community tag 'Authentication Bypass' combined with the CVSS confidentiality-only, scope-change profile is consistent with a broken access control or authorization weakness (CWE-284/CWE-863 class) that lets an authenticated user read data outside their intended authorization boundary. The scope change (S:C) indicates the vulnerable CTO component can be used as a pivot to reach data or resources governed by a different security authority within the integrated EBS suite.

Know when E Business Suite gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI 7.7 HIGH

Network HTTP reachable and easily exploitable (AV:N/AC:L), needs a low-privileged account (PR:L), no interaction, confidentiality-only with cross-product scope change (S:C/C:H/I:N/A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

DescriptionCVE.org

Vulnerability in the Oracle Configure to Order product of Oracle E-Business Suite (component: Supply to Order Workbench). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Configure to Order. While the vulnerability is in Oracle Configure to Order, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configure to Order accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

Executive ViewAI

Why It Matters

A data disclosure vulnerability in Oracle E-Business Suite's Configure to Order component (versions 12.2.3-12.2.15) allows any authenticated user to access sensitive application data, with its broader scope potentially compromising dependent supply chain and procurement systems. With no vendor patch currently available, organizations face immediate exposure of critical business data and should prioritize mitigation and vendor communication.

Business Impact: High

Compensating Controls

Until vendor patch is released: restrict Configure to Order access to the minimum necessary authenticated users, enforce multi-factor authentication for all accounts with access, implement data loss prevention controls to monitor and block unauthorized sensitive data exports, enable comprehensive audit logging on all queries and data retrievals, and establish continuous monitoring for suspicious access patterns or bulk data operations.

Threat Intelligence Overview

EPSS Score

0.4%

Top 72% exploitable

Prevalence

High

Oracle EBS is a widely deployed enterprise ERP in large organizations

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.