EUVD-2026-47474
GHSA-hjw5-x9v4-83pr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach EBS web tier over HTTP
-
DeliverySend crafted request to Cost Management endpoint
-
ExploitBypass authentication/authorization check
-
ExecutionRead critical cost-management data
-
ImpactExfiltrate sensitive business data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected component - Oracle In-Memory Cost Management for Discrete Industries (Internal Operations) - must be present and its HTTP endpoint reachable by the attacker on an EBS 12.2.3-12.2.15 deployment. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special privileges are required, so no special conditions beyond network reachability apply against affected default configurations. The primary limiting factors are therefore network exposure (instances isolated behind VPN/URL-firewall or not internet-facing are not remotely reachable) and version applicability (only 12.2.3 through 12.2.15 are listed as affected); impact is limited to data confidentiality, with no integrity or availability effect. |
| Impact | The CVSS vector AV:N/AC:L/PR:N/UI:N indicates remote, low-complexity, unauthenticated exploitation with no user interaction - the highest-exposure profile for the access dimensions - while the impact is confined to confidentiality (C:H, I:N, A:N), which is why the score caps at 7.5 rather than higher. Oracle's 'Easily exploitable' language reinforces the low-complexity rating. Countervailing signals lower urgency: no EPSS score was provided, the CVE is not listed in CISA KEV, and no public POC was identified, so there is no evidence of active or imminent mass exploitation at this time. Oracle EBS is historically a high-value target and prior EBS auth-bypass/data-disclosure bugs have drawn exploitation, so internet-facing instances should treat this as a real priority despite the absence of an exploitability probability. Note the tag claims 'Authentication Bypass' but the CVE text describes unauthorized data access; verify the precise nature with Oracle's advisory as this affects whether write/lateral impact is possible (Oracle scored I:N/A:N, so read-only disclosure is the confirmed impact). |
| Exploit ScenarioDerived | An attacker who can reach the EBS web tier over HTTP sends a crafted request to the In-Memory Cost Management for Discrete Industries endpoint and, without supplying valid credentials, retrieves sensitive cost-management and related business data. Because the attack requires no authentication, no user interaction, and low complexity, it can be scripted and run against any internet-exposed EBS 12.2.x instance; no public POC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Unauthorized data disclosure in the Oracle In-Memory Cost Management for Discrete Industries component (Internal Operations) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows an unauthenticated, network-based attacker over HTTP to read critical or all data accessible to the product. The flaw is rated CVSS 3.1 7.5 with a pure confidentiality impact (C:H/I:N/A:N) and was disclosed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, though the 'Authentication Bypass' tag and low attack complexity make it an attractive target for internet-exposed EBS instances.
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (patch available per vendor advisory; no standalone fix version string was provided in the input) by following the CPU documentation at https://www.oracle.com/security-alerts/cpujul2026.html and installing the corresponding EBS 12.2 patch for your version. Because Oracle bundles EBS fixes into the quarterly CPU and does not publish per-CVE point versions here, confirm the exact patch number for your 12.2.3-12.2.15 release in the CPU advisory. As compensating controls until patching, restrict network reachability of the affected In-Memory Cost Management / Internal Operations endpoints - place EBS behind a VPN or reverse proxy and block external HTTP access to the vulnerable servlet paths, and use Oracle's URL Firewall / allow-list (mod_security or the EBS DMZ 'url_fw' configuration) to permit only required responsibilities and pages; the trade-off is that overly broad URL blocking can break legitimate self-service or integration traffic, so validate allow-lists against active business flows before enforcing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite (EBS) is a large integrated ERP suite; the affected component, In-Memory Cost Management for Discrete Industries under the Internal Operations module, handles manufacturing cost calculations and stores sensitive business/financial data. Because exploitation occurs over HTTP without authentication, the weakness most plausibly resides in an EBS servlet, OA Framework page, or web endpoint that fails to enforce access control, consistent with the supplied 'Authentication Bypass' tag. No CWE was assigned in the input, but the behavior aligns with the missing-authentication/broken-access-control class (e.g., CWE-306 Missing Authentication for Critical Function or CWE-862 Missing Authorization). EBS 12.2.x runs on the Oracle WebLogic/Fusion Middleware and Oracle Database stack, and cost-management data typically includes proprietary product costing and financial figures.
Know when In Memory Cost Management For Discrete Industries gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated remote HTTP access with low complexity (AV:N/AC:L/PR:N/UI:N) yields high confidentiality disclosure only, with no integrity or availability impact per Oracle.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle In-Memory Cost Management for Discrete Industries product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle In-Memory Cost Management for Discrete Industries. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle In-Memory Cost Management for Discrete Industries accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Executive ViewAI
A critical data disclosure vulnerability in Oracle E-Business Suite (versions 12.2.3-12.2.15) allows unauthenticated attackers to access sensitive business data-financial records, operational intelligence, and customer information-via simple network requests. No public exploit identified at time of analysis, but the vulnerability's straightforward attack vector makes exploitation likely if systems remain internet-exposed. No vendor-released patch identified at time of analysis; leadership must immediately isolate affected systems and coordinate with Oracle on remediation strategy.
Implement network segmentation to isolate the In-Memory Cost Management component from internet-facing networks; enable detailed HTTP request logging with security alerts for unusual access patterns; deploy Web Application Firewall (WAF) rules to block exploitation attempts; enforce database-level access controls and audit trails; conduct regular security assessments of externally-exposed EBS instances; maintain encrypted offline backups to contain breach impact.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB