Oracle Lease Finance Management EUVD-2026-47492

Exploitation requires the attacker to already possess high privileges (PR:H) within the Oracle E-Business Suite / Oracle Lease and Finance Management application and network HTTP reachability to the OLFM Internal Operations component on a deployment running version 12.2.14 or 12.2.15. What limits exploitation: the high-privilege requirement means an unprivileged or unauthenticated outsider cannot exploit this directly - an attacker must first obtain a privileged EBS account; version is constrained to the 12.2.14-12.2.15 band; and the vulnerable OLFM module and its Internal Operations HTTP endpoints must be deployed and reachable. There is no user-interaction requirement (UI:N) and low attack complexity (AC:L) once the privilege precondition is met.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H yields 7.2 (High): remotely reachable over HTTP (AV:N), low attack complexity (AC:L), no user interaction (UI:N), and full triple impact (C:H/I:H/A:H). The decisive limiting factor is PR:H - the attacker must already hold high privileges within the EBS/OLFM application, which sharply narrows the realistic threat population to authenticated privileged insiders or attackers who have first stolen privileged credentials. Oracle's own phrase 'easily exploitable' aligns with AC:L, but the high-privilege gate means this is a privilege-abuse / post-compromise escalation risk rather than a wormable, internet-facing threat. No KEV listing and no public POC further support treating this as important-but-not-emergency; prioritize it in the normal Oracle CPU patch cycle unless privileged OLFM accounts are widely delegated. No conflicting signals were observed between the description ('network access via HTTP') and the CVSS vector - both agree on AV:N with PR:H.

A malicious or compromised privileged EBS user - for example, an OLFM administrator whose credentials were phished - sends crafted HTTP requests to the Lease and Finance Management Internal Operations interface and abuses the flaw to read, alter, and destroy lease and finance data, achieving full takeover of the module. No user interaction and only low attack complexity are required once privileged access exists; no public POC has been identified at time of analysis, so any near-term exploitation would rely on custom tooling by the privileged actor.