Oracle Public Sector Financials EUVD-2026-47515

Exploitation requires a valid low-privilege user account on the Oracle E-Business Suite instance - unauthenticated remote exploitation is not supported by the CVSS vector (PR:L). The attacker must have network access to the EBS HTTP interface and the target must be running Oracle Public Sector Financials versions 12.2.3 through 12.2.15. Exploitation is limited to the Internal Operations component; other EBS modules are not indicated as affected. The 'Authentication Bypass' tag suggests the flaw may not require the attacker's account to have any specific role or privilege within the Internal Operations module itself - a general low-privilege EBS account may suffice. No special platform, operating system, or non-default configuration is identified as a prerequisite. Limiting factors: requires prior authenticated access (eliminates fully external attackers without credentials), impact is partial rather than full data disclosure or system compromise, and availability is unaffected.

With a CVSS 3.1 base score of 5.4 (Medium), the primary risk is limited unauthorized access to financial data - partial confidentiality and integrity impact only, with no availability disruption. The AV:N/AC:L vector confirms easy remote reachability over HTTP with no special conditions, but PR:L establishes that exploitation requires prior authentication with at least a low-privilege account. This meaningfully constrains the exposed attack surface to insiders, compromised user accounts, or threat actors who have already achieved initial access. The 'Authentication Bypass' tag is noteworthy but potentially misleading in conjunction with PR:L - it more likely refers to authorization bypass within a session rather than pre-auth exploitation; this should be verified against the Oracle October/July 2026 CPU detail. EPSS data was not provided; given the medium CVSS, public-sector target base, and absence of KEV listing or POC, real-world exploitation risk is moderate and likely opportunistic rather than mass-scale. The data impact (financial record read/modify) is consequential for public-sector organizations subject to audit and compliance requirements, elevating business risk beyond what the raw CVSS score implies. No conflicting CVSS signals are present, but the CWE absence and ambiguous 'Authentication Bypass' tag reduce analytical confidence.

A low-privileged user with a valid Oracle EBS account - such as an internal employee or a contractor with minimal system access - sends a crafted HTTP request to the Internal Operations component of Oracle Public Sector Financials. By exploiting the authorization control flaw, the attacker reads financial records or modifies data beyond their assigned permissions, potentially tampering with budget entries, vendor payment records, or procurement data. No public exploit code exists at time of analysis, so exploitation likely requires manual discovery of the specific request pattern.