EUVD-2026-47461
GHSA-fv3r-2cmf-26v6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Low-privileged HTTP network authentication required; partial and scope-unchanged impacts across all three pillars align precisely with the vendor-confirmed description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Sales for Handhelds product of Oracle E-Business Suite (component: Outlook Sync Win 32). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales for Handhelds. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Sales for Handhelds accessible data as well as unauthorized read access to a subset of Oracle Sales for Handhelds accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Sales for Handhelds. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
AnalysisAI
Oracle Sales for Handhelds (E-Business Suite versions 12.2.3-12.2.15) exposes a network-exploitable flaw in its Outlook Sync Win 32 component that allows low-privileged authenticated users to perform unauthorized data reads, writes, and cause a partial denial of service via HTTP. Oracle classified this as easily exploitable, with low attack complexity and no user interaction required beyond holding a valid low-level account. No public exploit identified at time of analysis and it does not appear in the CISA KEV catalog, but the low barrier to exploitation makes it a credible insider or compromised-credential threat for affected EBS deployments.
Technical ContextAI
The affected component is Outlook Sync Win 32, a Windows-based synchronization subsystem within Oracle Sales for Handhelds, a mobile sales application module bundled with Oracle E-Business Suite (EBS). The Microsoft tag in the intelligence data corroborates the Windows-client nature of the affected component. Supported EBS versions 12.2.3 through 12.2.15 are confirmed affected per Oracle's July 2026 CPU advisory. No CWE identifier was assigned, so the precise root-cause class - likely improper authorization, insufficient input validation, or broken access control within the sync endpoint - remains unspecified by the vendor. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U) indicates the vulnerable endpoint is accessible over HTTP, requires no special configuration to trigger, and produces contained (non-scope-changing) impact across all three security pillars at a partial level.
RemediationAI
Apply the patch issued as part of Oracle's Critical Patch Update for July 2026, available through the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number is not independently confirmed from available data - consult the CPU advisory and My Oracle Support for the specific patch set applicable to your EBS version. If immediate patching is not feasible, restrict HTTP access to the Outlook Sync Win 32 endpoint at the network or application layer to only explicitly authorized user accounts, reducing the pool of potential exploiters; note this may disrupt legitimate Outlook synchronization workflows for affected users. Enforce least-privilege account hygiene on EBS to ensure low-privileged credentials cannot be trivially abused, and monitor HTTP access logs to the Sales for Handhelds Outlook Sync endpoint for anomalous patterns.
More in Sales For Handhelds
View allFull system takeover of Oracle Sales for Handhelds (E-Business Suite versions 12.2.3-12.2.15) is achievable by any low-p
Vulnerability in the Oracle Sales for Handhelds product of Oracle E-Business Suite (component: Pocket Outlook Sync(Pocke
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today