Public Sector Financials EUVD-2026-47514

Exploitation requires a valid, low-privileged Oracle E-Business Suite user account with HTTP network connectivity to the EBS application server hosting Public Sector Financials. The affected module (Internal Operations) must be deployed, which is standard in Public Sector Financials installations. Exploitation is limited to data read access; no write, delete, or code-execution capability is indicated. The 'Authentication Bypass' tag suggests the bypass operates at the intra-application authorization layer (role or object-level), meaning that possession of any EBS login credential - not necessarily one with permissions to the Internal Operations component - may be sufficient. External unauthenticated attackers are excluded unless they first obtain EBS credentials. No specific non-default configuration trigger is described, implying the flaw affects standard deployments of the named versions.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a meaningful but bounded risk: any authenticated low-privileged user on the network can trivially read all data accessible within the application. The low attack complexity and absence of user interaction interaction requirements make exploitation straightforward for any insider or credential-holding external attacker. However, the scope is unchanged (S:U), and integrity and availability are unaffected (I:N/A:N), limiting the blast radius to data exfiltration. A notable analytical tension exists between the 'Authentication Bypass' tag in ENISA EUVD data and the CVSS PR:L metric - a true authentication bypass would typically yield PR:N; the PR:L assignment suggests an authenticated user bypasses role-based or object-level authorization rather than subverting login entirely. This distinction matters for defenders: the attack requires at minimum a valid EBS user account. No EPSS score was provided; without it, exploitation probability cannot be quantified precisely, but the trivial exploitation mechanics (AV:N/AC:L) suggest high exploitation likelihood if credentials are obtained. No KEV listing and no POC reduce immediate urgency, but the sensitivity of public-sector financial data elevates the impact classification for affected organizations.

An attacker holding a low-privileged Oracle EBS user account - obtained via credential phishing, password reuse, or insider access - sends a crafted HTTP request to the Internal Operations component, bypassing the intended authorization check. The attacker receives a full data dump or is able to iterate over financial records across all organizational units within the Public Sector Financials application, exfiltrating sensitive government budget, procurement, or payment data without triggering standard access-control denials.