Oracle Advanced Benefits EUVD-2026-47484

Exploitation requires network HTTP access to the Oracle E-Business Suite Advanced Benefits Internal Operations component and a valid low-privileged EBS account (CVSS PR:L) - it is not fully unauthenticated despite the reporter's 'Authentication Bypass' tag, which conflicts with the vector. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker must already possess low-level credentials and be able to reach the EBS HTTP endpoints, so deployments that restrict Advanced Benefits/Internal Operations access to trusted internal networks and tightly scope low-privilege roles materially reduce realistic exposure. Only supported version 12.2.15 is named as affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N, base 7.7) describes an easily exploitable, network-reachable flaw requiring only low privileges and no user interaction, with high integrity impact and a scope change - a genuine concern for internet- or intranet-exposed EBS deployments where many users hold low-privilege accounts. However, no EPSS score, KEV listing, POC, or SSVC data was provided, so there is no evidence of active exploitation: this is a high-CVSS issue without confirmed real-world weaponization. Note a signal conflict: the CVSS vector states PR:L (a valid low-privilege account is required), yet the reporter tag labels this 'Authentication Bypass', which would imply no valid credentials - the PR:L vector should be treated as authoritative unless Oracle clarifies otherwise. Confidentiality and availability are unaffected (C:N/A:N), so the practical risk is data tampering/integrity, not data theft or outage.

An attacker who holds any low-privileged EBS account (or obtains one via phishing/credential reuse) sends crafted HTTP requests to the Advanced Benefits Internal Operations component and abuses missing authorization to create, alter, or delete benefits and related critical data. Given the scope change, the tampering can ripple into other EBS products or shared platform data. No public exploit code has been identified, and no user interaction is required (UI:N).