EUVD-2026-47349
GHSA-ww93-2cgf-gw86
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged EBS user
-
DeliveryReach Advanced Benefits ACA HTTP endpoint
-
ExploitSend crafted request meeting complex preconditions
-
ExecutionBypass authorization in ACA component
-
PersistTake over Advanced Benefits module
-
ImpactRead/alter/disrupt benefits data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access over HTTP to an Oracle E-Business Suite instance running Oracle Advanced Benefits (versions 12.2.7-12.2.15) with the Affordable Care Act component in use, and the attacker must hold valid low-privileged application credentials (PR:L - not anonymous/unauthenticated). Exploitation is further limited by high attack complexity (AC:H), meaning success depends on conditions the attacker does not directly control (e.g., specific application state, timing, or configuration), and by scope being unchanged (S:U), so impact is confined to the Advanced Benefits module itself. No user interaction is required (UI:N). |
| Impact | The signals are mixed and point to a genuine but not top-tier emergency priority. CVSS 3.1 is 7.5 (High) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H: network-reachable and needing only low privileges, but the AC:H (high attack complexity) materially lowers practical exploitability because success depends on conditions outside the attacker's control. There is no EPSS score, no POC, and no KEV entry in the provided data, so there is no evidence of active or imminent widespread exploitation. The vendor 'Information Disclosure' tag conflicts somewhat with the C:H/I:H/A:H 'takeover' language in the description - verify the true impact with Oracle, but the CVSS-declared full-impact triad should take precedence for prioritization. Net: a real, patch-now issue for EBS operators handling sensitive HR/benefits data, but the low-privilege requirement plus high complexity make mass opportunistic exploitation less likely than a targeted attack by an existing authenticated user. |
| Exploit ScenarioDerived | A low-privileged but authenticated Oracle E-Business Suite user (for example, an HR self-service account) sends specially crafted HTTP requests to the Advanced Benefits ACA functionality, abusing a flaw to escalate their access and take over the module - reading sensitive benefits/healthcare data and altering or disrupting records. The high attack complexity means the attacker must satisfy specific application-state or configuration conditions for the attack to succeed. No public proof-of-concept is known at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Full compromise of the Oracle Advanced Benefits module (Affordable Care Act component) within Oracle E-Business Suite 12.2.7 through 12.2.15 is possible by a low-privileged, authenticated attacker sending crafted HTTP requests over the network. Successful exploitation yields complete takeover of the module with high confidentiality, integrity, and availability impact. This is a July 2026 Oracle Critical Patch Update issue with no public exploit identified at time of analysis and no CISA KEV listing.
RemediationAI
Apply the fixes from the Oracle July 2026 Critical Patch Update as documented at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle delivers EBS 12.2 fixes as cumulative CPU patches applied on top of the 12.2.x codelevel, so identify and install the specific OAB/ACA patch listed in that CPU for your running 12.2.7-12.2.15 level (no standalone fixed version string was provided in the input, so do not assume a version number - pull the exact patch ID from the CPU). Until patched, reduce exposure by restricting network access to the Oracle Advanced Benefits and ACA self-service/administration pages to trusted internal networks or VPN, limiting and reviewing which authenticated accounts have OAB responsibilities (since PR:L means an authenticated low-privileged user is the threat), and increasing monitoring/WAF inspection of HTTP traffic to the affected EBS functions; note these controls can disrupt legitimate benefits-administration workflows and ACA reporting cycles and are stopgaps, not substitutes for the CPU patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Advanced Benefits (OAB) is a benefits administration module of the Oracle E-Business Suite (EBS) HCM stack, and the affected code sits in its Affordable Care Act (ACA) component, which handles US employer healthcare compliance reporting. EBS is a large web-based ERP platform typically fronted by Oracle HTTP Server / WebLogic and accessed over HTTP, which aligns with the network attack vector. No CWE was assigned by NVD, so the precise root-cause class is not confirmed; the vendor tag 'Information Disclosure' hints at data exposure, but the CVSS vector's high integrity and availability impacts indicate the flaw goes beyond mere disclosure to full module compromise, suggesting an authorization/access-control or injection weakness in the ACA feature reachable by authenticated application users.
Know when Advanced Benefits gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP reach (AV:N) by an authenticated low-privilege user (PR:L), with high complexity (AC:H) preconditions; full module takeover justifies C:H/I:H/A:H and S:U.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Affordable Care Act). Supported versions that are affected are 12.2.7-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Benefits. Successful attacks of this vulnerability can result in takeover of Oracle Advanced Benefits. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Advanced Benefits module in E-Business Suite 12.2.7-12.2.15 can be fully compromised by any authenticated user, disabling critical ACA compliance and benefits administration capabilities. No public exploit has been identified at time of analysis, and no vendor patch is currently available, leaving organizations dependent on immediate access controls and network mitigations.
Restrict authentication to the Advanced Benefits module to only essential personnel; remove access from inactive users; implement network segmentation between Oracle E-Business Suite and general corporate networks; deploy Web Application Firewall rules targeting the module's HTTP endpoints; enable comprehensive audit logging for all module transactions; monitor for exploitation indicators including anomalous user access patterns and unexpected data retrieval; consider temporary module disablement if organizational risk tolerance is insufficient while awaiting patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Advanced Benefits
View allUnauthorized data manipulation in Oracle Advanced Benefits 12.2.15 (Oracle E-Business Suite, Internal Operations compone
Privilege-abusing data compromise in Oracle Advanced Benefits 12.2.15 (a module of Oracle E-Business Suite, Internal Ope
Unauthorized data access in Oracle Advanced Benefits 12.2.15 can be achieved by any low-privileged authenticated attacke
Partial compromise of Oracle Advanced Benefits (Self Service Benefits component) is achievable by any low-privileged, ne
Unauthorized data access and partial denial of service in Oracle Advanced Benefits (E-Business Suite Self Service Benefi
Exploit-DB