Oracle Advanced Benefits EUVD-2026-47483

Exploitation requires an active, low-privileged authenticated session on Oracle E-Business Suite - any valid EBS user account suffices, including those with minimal role assignments. Network access to the EBS application server via HTTP is also required. Exploitation is limited to Oracle Advanced Benefits version 12.2.15 specifically; other EBS versions are not confirmed affected. No special non-default configurations are required. Limiting factors include: the attacker must possess or obtain valid EBS credentials (PR:L eliminates fully unauthenticated exploitation), and impact is confined to confidentiality with no write or availability effect (I:N, A:N). Environments that restrict EBS access to internal networks or VPN reduce exposure, but do not eliminate the insider threat vector.

The CVSS 6.5 Medium score reflects a significant real-world confidentiality risk constrained by the requirement for low-privilege authentication (PR:L). No EPSS score was provided in the source data, so exploitation probability cannot be quantified numerically; absence of KEV listing and no confirmed POC suggests this is not currently being exploited at scale. The 'Authentication Bypass' tag introduces a nuance: while PR:L indicates some authentication is needed, the flaw may allow privilege escalation within the application - meaning any EBS user with a basic account could access HR and benefits data they are not authorized to view. The attack complexity is low (AC:L) and no user interaction is required (UI:N), so exploitation is straightforward for any insider or attacker who has obtained credentials. The primary risk population is organizations running EBS 12.2.15 with the Advanced Benefits module active and internet- or intranet-exposed. No conflicting signals between CVSS and description were identified.

An attacker with a low-privileged Oracle EBS account - such as a regular employee or a compromised service account - sends a crafted HTTP request to the Internal Operations component of Oracle Advanced Benefits. By exploiting the authorization bypass, the attacker enumerates and extracts sensitive HR benefits records, compensation data, or personal employee information beyond their assigned role. No special tooling is required beyond an authenticated HTTP session, making this accessible to insider threats or attackers who have phished EBS credentials.