Oracle Work in Process EUVD-2026-47499

Exploitation requires network HTTP access to the Oracle Work in Process / EBS application tier and a valid low-privileged EBS account (CVSS PR:L - authenticated, not a pre-auth bypass despite the third-party 'Authentication Bypass' tag). No user interaction is required (UI:N), attack complexity is low (AC:L), and only versions 12.2.14 through 12.2.15 with the Work in Process module (Internal Operations component) deployed are affected. Limiting factors: the attacker must first hold or acquire credentials, and impact is confined to data readable/writable by the WIP application (availability is not affected, A:N). Real-world risk rises sharply where the EBS web tier is internet-facing or where many users hold low-privilege accounts.

The signals are moderately consistent toward a real, actionable priority for organizations running EBS 12.2. The CVSS vector (AV:N/AC:L/PR:L/UI:N) means network-reachable, low-complexity, no user interaction, requiring only a low-privileged account - Oracle explicitly calls it 'easily exploitable,' and the high C and I impacts (A:N) indicate data theft and tampering rather than outage. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified here. It is NOT in CISA KEV and no POC is referenced, so there is no evidence of active exploitation - this is a patch-on-cycle item rather than an emergency zero-day. The main caveat: PR:L requires the attacker to already hold some valid EBS credential/session, so the raw 8.1 overstates risk where EBS is not internet-exposed and credentials are tightly controlled, but understates it where EBS self-service or partner access is externally reachable. The 'Authentication Bypass' tag is a third-party label and mildly conflicts with the PR:L vector (a true unauthenticated bypass would be PR:N) - treat the auth requirement as PR:L per the CVSS vector and verify scope with Oracle.

An attacker who has obtained any low-privileged Oracle E-Business Suite account (for example a limited self-service or shop-floor user) sends crafted HTTP requests to the Work in Process Internal Operations endpoints and, exploiting the authorization weakness, reads or alters manufacturing data far beyond their assigned privileges - tampering with work orders and production data, or exfiltrating all WIP-accessible records. Because attack complexity is low and no user interaction is needed, the request can be scripted; no public POC is currently identified.