Oracle E-Business Suite EUVD-2026-47552

Exploitation requires a low-privileged authenticated account on the Oracle E-Business Suite instance (CVSS PR:L) with network HTTP access to the HRMS (UK) UK Payroll component; no user interaction and no high privileges are needed, and Oracle classifies it as easily exploitable (AC:L). Limiting factors: the target must be running an affected EBS release in the 12.2.3-12.2.15 range with the HRMS (UK) / UK Payroll module deployed and reachable, and the attacker must first obtain valid (even minimal) EBS credentials - so instances not exposing EBS web tiers to untrusted users, or not running the UK Payroll module, are not exploitable. The 'Authentication Bypass' tag hints privilege requirements could be lower in practice, but the CVSS vector confirms only PR:L, so authenticated low-privilege access should be assumed unless Oracle states otherwise.

This is a genuine high-priority issue rather than an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) describes network-reachable, low-complexity, low-privilege exploitation with no user interaction and cross-scope impact to confidentiality and integrity - Oracle explicitly labels it 'easily exploitable,' aligning with AC:L. Availability impact is None (A:N), so this is a data-exposure and data-tampering threat, not a denial-of-service. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability and active-exploitation status cannot be quantified from the input; the 'no public exploit identified' status reflects absence of evidence, not confirmed absence of risk. The one conflict to verify: the intelligence tag says 'Authentication Bypass,' yet the CVSS vector requires PR:L (a low-privileged authenticated account) - verify with Oracle whether any authentication bypass truly enables unauthenticated access, which would raise real-world risk above the PR:L rating.

A low-privileged EBS user (for example, a standard employee self-service account) sends crafted HTTP requests to the HRMS UK Payroll component, exploiting the flaw to read and alter payroll and personnel records they should not access. Because of the scope change, the attacker leverages the shared EBS tier to reach and tamper with data belonging to other Oracle EBS modules. No public POC is available at time of analysis, but Oracle rates the vulnerability as easily exploitable.