Marketing Encyclopedia System EUVD-2026-61647

The attacker must have a low-privileged authenticated account within the Oracle E-Business Suite environment - standard employee or read-only EBS accounts satisfy this requirement. Network access to the EBS application server over HTTP is required; this is a standard condition for any EBS user. No user interaction from a victim is needed. The affected product must be running Oracle EBS version 12.2.3 through 12.2.15 with the Marketing Encyclopedia System component active. The 'Authentication Bypass' reporter tag raises the question of whether even the PR:L requirement can be circumvented - if so, the effective exploitation condition drops to unauthenticated network access, but this is not confirmed from available data. Exploitation is NOT limited to any specific OS platform or database configuration beyond the EBS version range. There is no requirement for a non-default configuration - MES Internal Operations is a standard EBS component.

The CVSS 3.1 score of 7.7 (High) is driven by network access vector, low attack complexity, low privilege requirement, no user interaction, scope change, and high confidentiality impact - a combination that accurately reflects the real-world severity. The scope change elevates the score meaningfully beyond what a contained confidentiality flaw would warrant. EPSS data was not provided in the source intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no POC has been identified, which moderates near-term exploitation urgency. However, Oracle E-Business Suite is widely deployed in large enterprises, and any authenticated user with a basic EBS account could potentially exploit this - meaning even a mid-sized municipal IT team in boleslawiec running an EBS deployment should treat this as an urgent patch cycle item given the low exploitation bar. The 'Authentication Bypass' tag introduces some ambiguity: if the PR:L prerequisite can itself be bypassed, the effective risk is higher than the CVSS vector reflects. This discrepancy between the tag and the vector should be verified against the full Oracle advisory.

An attacker with a low-privileged Oracle EBS account - such as a standard employee user - sends crafted HTTP requests to the Internal Operations component of Oracle Marketing Encyclopedia System over the network. By exploiting the improper authorization flaw, the attacker reads sensitive business data across the MES application and potentially adjacent EBS modules due to the scope change. No public exploit code has been identified at time of analysis, but the low complexity and minimal prerequisites make independent exploitation development straightforward for a motivated attacker.