What is the CVSS score of EUVD-2026-47547?

EUVD-2026-47547 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by EUVD-2026-47547?

Organizations using Oracle E-Business Suite versions 12.2.11 through 12.2.15 face critical risk of complete system compromise through the Web Utilities component, potentially exposing financial data,…

How to fix or mitigate EUVD-2026-47547?

Within 24 hours, identify all systems running Oracle EBS 12.2.11-12.2.15, verify which instances are accessible over the network, assess user account counts and privilege levels, and initiate incident response procedures. Within 7 days, implement network segmentation to restrict EBS HTTP access to authorized networks only, enforce strict authentication controls, deploy Web Application Firewall rules to detect and block exploitation attempts against the Web Utilities component, and enable enhanced logging on authentication and administrative actions. Within 30 days, monitor Oracle's advisory for patch releases, coordinate an upgrade plan to patched EBS versions, complete security testing of the upgrade path, and transition fully to patched versions while maintaining compensating controls through the transition period.

Oracle E-Business Suite EUVD-2026-47547

| CVE-2026-62534 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-v4r8-6r5r-r9wh

Authentication Bypass Oracle Applications Framework

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reachable (AV:N), low complexity, requires a low-privilege EBS account (PR:L), no user interaction, and full framework takeover yields C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:36 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities). Supported versions that are affected are 12.2.11-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in takeover of Oracle Applications Framework. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Privilege-abusing account takeover in Oracle Applications Framework (Web Utilities component) of Oracle E-Business Suite 12.2.11 through 12.2.15 lets a low-privileged, network-authenticated attacker fully compromise the framework over HTTP, gaining full confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis and the CVE is not on CISA KEV; it was disclosed through the Oracle July 2026 Critical Patch Update.

Technical ContextAI

Oracle Applications Framework (OAF) is the Java/J2EE presentation and business-logic layer underpinning the self-service web interfaces of Oracle E-Business Suite (EBS), Oracle's flagship ERP/financials/HR/supply-chain suite. The affected 'Web Utilities' sub-component handles HTTP-facing utility functionality exposed to authenticated application users. Oracle does not publish a CWE for this issue (CWE: N/A), and no technical root-cause detail is released in the advisory, which is standard for Oracle CPU entries; the 'takeover of Oracle Applications Framework' language combined with a full CIA impact profile is consistent with an authorization or injection class flaw that lets a low-privileged user escalate to full control of the OAF context. Exact affected binaries are not published as CPE strings in the provided data.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected EBS 12.2.11-12.2.15 releases; Oracle ships this as a cumulative CPU patch rather than a single tagged version number, so use the patch identifiers listed in the advisory for your exact release (Patch available per vendor advisory - no standalone fix version string is published in the input). Because exploitation only needs a low-privileged account, compensating controls until patching completes include restricting network reachability of the EBS self-service/OAF endpoints to trusted networks or VPN, tightening the OAF URL firewall / DMZ configuration to limit which servlets and responsibilities are externally exposed, auditing and pruning low-privilege user accounts, and increasing monitoring of OAF Web Utilities request patterns; note that DMZ/URL-firewall tightening can break legitimate external self-service functionality and must be validated against business use.