What is the CVSS score of EUVD-2026-47527?

EUVD-2026-47527 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle Flow Manufacturing are affected by EUVD-2026-47527?

Oracle Flow Manufacturing (E-Business Suite 12.2.13-12.2.15) contains a critical data access flaw allowing authenticated low-privileged users to read, create, delete, and modify all data accessible…

How to fix or mitigate EUVD-2026-47527?

Within 24 hours, inventory all systems running Oracle E-Business Suite versions 12.2.13 through 12.2.15 with Flow Manufacturing component and assess network accessibility. Immediately restrict HTTP access to affected instances via firewall rules and disable unnecessary application endpoints. Within 7 days, implement supplemental authentication controls for low-privileged user accounts, reduce low-privileged account count to operational minimum, and enable comprehensive audit logging on all data access and modification operations. Within 30 days, plan and test migration to Oracle E-Business Suite 12.2.16 or later once vendor patches are released and validated in non-production environment.

Oracle Flow Manufacturing EUVD-2026-47527

| CVE-2026-62497 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-4c2q-pqjh-9v54

Authentication Bypass Oracle Flow Manufacturing

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-reachable HTTP flaw exploitable by a low-privileged account with no user interaction; full confidentiality and integrity loss but no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:40 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.13-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Flow Manufacturing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Flow Manufacturing accessible data as well as unauthorized access to critical data or complete access to all Oracle Flow Manufacturing accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Flow Manufacturing (Oracle E-Business Suite 12.2.13-12.2.15, Internal Operations component) allows a low-privileged remote attacker over HTTP to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (high) with full confidentiality and integrity impact but no availability impact. No public exploit is identified at time of analysis and it is not listed in CISA KEV; disclosure is via Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Flow Manufacturing is a module within Oracle E-Business Suite (EBS), Oracle's on-premises ERP application delivered over a web (HTTP) tier and backed by an Oracle Database. The flaw resides in the Internal Operations component. Oracle does not publish a CWE for CPU findings (CWE: N/A here), but the impact profile - a low-privileged authenticated user gaining broad access to all data the application can reach with no availability effect - is consistent with a broken access control / authorization weakness (CWE-284/CWE-285), corroborated by the supplied 'Authentication Bypass' tag. EBS deployments are typically internet- or intranet-facing multi-tier Java/PL-SQL applications, so an HTTP-reachable authorization flaw exposes the underlying business data set.

RemediationAI

Apply the fixes in Oracle's July 2026 Critical Patch Update; Oracle ships EBS security fixes as CPU patches for the 12.2 release line rather than as new point versions, so an exact standalone fix version is not stated in the input - consult https://www.oracle.com/security-alerts/cpujul2026.html for the specific patch and My Oracle Support patch numbers matching your 12.2.13-12.2.15 level. Until patched, restrict network reachability of the EBS web tier by placing it behind a VPN or IP allowlist and terminating untrusted access at a reverse proxy/WAF, and tighten application role and responsibility assignments so low-privileged accounts cannot reach the Internal Operations/Flow Manufacturing functions - these controls reduce exposure but do not remove the flaw and may impede legitimate remote or partner users. Review application and database audit logs for anomalous data access or modification within Flow Manufacturing as a detective control.