Oracle Marketing EUVD-2026-47458

Exploitation requires a valid low-privileged authenticated account within the Oracle E-Business Suite environment and HTTP network access to the EBS application tier. The vulnerable feature is the Audience component within the Oracle Marketing module; only deployments running EBS versions 12.2.3 through 12.2.15 are confirmed affected. Limiting factors: unauthenticated external attackers cannot exploit this without first obtaining valid EBS credentials (PR:L); impact is bounded to partial CIA outcomes within Oracle Marketing's own data scope (S:U, C:L/I:L/A:L) and does not extend to operating system, database, or other EBS modules; attack complexity is low, requiring no special race conditions or non-default configurations beyond having access to the Audience component.

The vendor-assigned CVSS 3.1 base score of 6.3 (Medium) accurately reflects the limited blast radius: partial confidentiality, integrity, and availability impacts, all constrained to Oracle Marketing's own data domain (S:U). The AV:N/AC:L/PR:L configuration means any attacker with a valid low-privileged EBS account and HTTP network access can attempt exploitation without elevated complexity. No EPSS score was available in the source data, and the vulnerability is absent from the CISA KEV catalog, suggesting no confirmed active exploitation at time of analysis. No public POC code was identified. Real-world risk is moderate and bounded: meaningful in environments with untrusted or semi-trusted low-privileged Oracle EBS users (e.g., contractor accounts, shared logins), but limited in impact to partial data exposure and partial availability disruption within a single EBS module. The unchanged scope prevents lateral movement to adjacent systems.

A low-privileged Oracle EBS user - such as a marketing analyst, contractor, or junior employee with a standard application account - sends crafted HTTP requests targeting the Oracle Marketing Audience component without requiring any user interaction from a privileged party. The attacker leverages insufficient authorization controls to read marketing data subsets beyond their access level, insert or alter audience records, and intermittently degrade Oracle Marketing availability. No public exploit code has been identified, so exploitation currently requires manual, application-layer interaction rather than automated tooling.