Oracle Payables EUVD-2026-47481

Exploitation requires a valid but low-privileged Oracle E-Business Suite account (CVSS PR:L) with network HTTP access to the EBS application tier hosting the Oracle Payables Internal Operations component, against affected versions 12.2.8 through 12.2.15. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The limiting factors are: the attacker must already be authenticated to EBS (not fully unauthenticated), must be able to reach the Payables HTTP endpoint over the network, and the target must run an affected 12.2.8-12.2.15 release; internet-exposed EBS instances with broad low-privilege user populations are most at risk.

The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding full CIA impact - a genuinely high-priority profile for any exposed EBS instance. No EPSS score, POC, or KEV status was supplied, so exploitation probability cannot be quantified from the data and there is no evidence of active exploitation; the risk is therefore driven by ease-of-exploitation and impact rather than confirmed in-the-wild activity. One conflict to verify: the tags label this 'Information Disclosure', yet the vector and Oracle's 'takeover' wording assert full integrity and availability impact, not just disclosure - treat it as a full-compromise issue and rely on the CVSS/description over the tag. The PR:L requirement (a valid EBS account) is the main real-world limiter, making this most dangerous where many internal or semi-trusted users hold accounts.

An attacker who has obtained any low-privilege Oracle EBS account - for example a disgruntled employee, contractor, or an outsider who phished a basic user credential - sends crafted HTTP requests to the Payables Internal Operations endpoint and abuses the flaw to gain full control of the Payables module, enabling manipulation of vendor and payment data. Given AC:L and no required user interaction, the attack is straightforward once a valid session exists; no public exploit code has been identified at time of analysis.