Oracle Project Contracts EUVD-2026-47516

Exploitation requires the attacker to hold an active, low-privileged user account within the Oracle E-Business Suite deployment - unauthenticated external exploitation is not possible per the CVSS PR:L vector. The target system must be running Oracle Project Contracts versions 12.2.3 through 12.2.15 and the Internal Operations component must be accessible via HTTP. No special non-default configuration is required beyond the existence of the vulnerable component. Exploitation is constrained by: (1) requirement for a valid EBS credential at any privilege level, limiting risk to insider or credential-compromised scenarios; (2) impact limited to data integrity within Project Contracts accessible data - no confidentiality leak or system availability impact; and (3) no scope change (S:U), so lateral movement to other EBS modules or underlying OS is not a direct consequence of this flaw alone.

The CVSS 3.1 base score of 4.3 (Medium) reflects a constrained impact: integrity-only, low severity, no confidentiality or availability consequences, and scoped to the vulnerable system (S:U). The AV:N/AC:L combination indicates the flaw is network-reachable with no special complexity, increasing ease of exploitation. However, PR:L is a meaningful barrier - exploitation requires a valid, low-privileged EBS account, limiting exposure to insiders or external attackers who have already obtained credentials. No EPSS data was provided in the source intelligence, so exploitation probability cannot be quantified probabilistically. No KEV listing and no POC code are identified, suggesting this has not been weaponized or observed in active campaigns. The 'Authentication Bypass' tag from the EUVD entry adds contextual concern: if this represents a lateral privilege escalation within EBS (rather than a bypass of login), the practical impact to confidential contract data integrity could exceed what the low I:L score implies for targeted insider-threat or privilege-misuse scenarios. Overall, this is a genuine but moderate-priority issue - meaningful for organizations with untrusted internal EBS users or contractor-level access, but not an emergency patch outside those contexts.

An attacker holding a standard low-privileged Oracle EBS user account - such as a project viewer, contractor, or junior employee - sends a crafted HTTP request to the Internal Operations component of Oracle Project Contracts, bypassing server-side authorization checks. The request manipulates contract records (inserts, updates, or deletes) that the attacker's role should not permit, potentially falsifying project cost data, modifying contract terms, or deleting audit-relevant entries. No public proof-of-concept code has been identified, but the low attack complexity (AC:L) means an attacker who understands the EBS request structure could develop an exploit without specialized tooling.