EUVD-2026-47482
GHSA-gwv7-rpcv-pmf9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP reachable with low-privilege authentication and no user interaction (AV:N/AC:L/PR:L/UI:N); module takeover gives full C:H/I:H/A:H, scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the TeleSales product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise TeleSales. Successful attacks of this vulnerability can result in takeover of TeleSales. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full compromise of the Oracle E-Business Suite TeleSales module (Internal Operations component) is possible over the network via HTTP by a low-privileged authenticated user. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation results in complete takeover of TeleSales with high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). This flaw was disclosed in the Oracle July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
Oracle E-Business Suite is Oracle's flagship integrated ERP/CRM application suite; TeleSales is its CRM module for managing sales interactions, and the affected code lives in the Internal Operations component. EBS 12.2.x runs on the Oracle WebLogic/Oracle HTTP Server middleware tier with servlet- and JSP-based web endpoints backed by an Oracle database, so a network-reachable HTTP interface is the exposed attack surface. Oracle assigned no CWE (CWE: N/A) and, per its standard Critical Patch Update practice, does not disclose the specific root cause; the vendor tag 'Information Disclosure' plus the C:H/I:H/A:H vector and 'takeover' language point to a server-side application flaw that escalates a low-privilege session into full control of the module rather than a mere read-only leak.
RemediationAI
Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) - patch available per vendor advisory; Oracle publishes the specific EBS 12.2 patch numbers within that CPU, and no separate standalone fixed version string was supplied in this input, so consult the CPU matrix for the exact patch for your 12.2.3-12.2.15 level. Because Oracle only supports patched configurations, prioritize applying the CPU patch on all EBS tiers. As compensating controls until patched, restrict network reachability of the TeleSales/Internal Operations HTTP endpoints - front them behind a reverse proxy or WAF and limit access to trusted internal networks/VPN rather than exposing them to the internet (trade-off: may block legitimate remote sales users); tighten EBS user provisioning and revoke unnecessary low-privilege TeleSales responsibilities since exploitation requires only a low-privileged account (trade-off: operational review overhead); and increase monitoring of TeleSales module access logs for anomalous activity.
Unauthorized data compromise in Oracle TeleSales (Oracle E-Business Suite, Internal Operations component) versions 12.2.
Unauthorized data access in Oracle TeleSales (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged, network
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today