Oracle E-Business Suite EUVD-2026-47557

Exploitation requires the attacker to have low-privilege logon access (PR:L) to the infrastructure where Oracle HRMS (US) executes - i.e., a valid but unprivileged EBS/host account or an existing foothold on the application tier - and to reach the Internal Operations component of a supported EBS 12.2.3-12.2.15 deployment. The attack vector is local (AV:L), not network, which is the primary limiting factor: remote unauthenticated exploitation is not possible from the input data. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once local low-privilege access is obtained, no special non-default configuration is indicated by the available data. Deployments running any 12.2.x release in the affected range are in scope.

The CVSS 3.1 base score is 7.8 (High), driven by local attack vector (AV:L), low complexity (AC:L), low privileges (PR:L), no user interaction (UI:N), and high impact across confidentiality, integrity, and availability. The local vector and requirement for existing low-privilege logon materially reduce real-world exposure compared with a network-exploitable RCE - an attacker must already have a valid account or foothold on the EBS infrastructure, which is a meaningful barrier for a properly segmented ERP deployment. No EPSS score, SSVC decision, POC, or KEV listing was provided, so exploitation probability cannot be quantified and there is no evidence of active exploitation. Oracle rates it 'easily exploitable,' which is consistent with AC:L, but the absence of a network vector means this is a privilege-escalation / insider-or-post-compromise risk rather than a mass-scannable internet threat. Note the potential tension: Oracle's 'Information Disclosure' tag understates the assigned I:H/A:H impacts - treat the full CIA impact as authoritative.

An attacker who already holds a low-privileged Oracle EBS account or has gained a foothold on an EBS application server abuses the Internal Operations component of Oracle HRMS (US) to elevate access and fully take over the HRMS module, reading and altering sensitive HR and payroll data. Because the CVSS complexity is low and no user interaction is required, the action is straightforward once the initial local access exists. No public exploit code has been identified at time of analysis.