EUVD-2026-79400
GHSA-79x2-3gq3-gw6c
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-reachable HTTP endpoint with no user interaction, but a valid low-privilege application account is required, so PR:L and AC:L; no availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Search Bean [Incl. Advanced]). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Applications Framework accessible data as well as unauthorized access to critical data or complete access to all Oracle Applications Framework accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
AnalysisAI
Authenticated low-privileged users of Oracle E-Business Suite 12.2.3 through 12.2.15 can abuse the Applications Framework 'Search Bean' component to read, create, delete, or modify critical data they should not be able to touch, giving an attacker with a basic application account broad confidentiality and integrity impact across the framework. The vulnerability is remotely reachable over HTTP with low attack complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1), so any valid low-privilege credential is effectively a stepping stone to full data compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, authenticated Oracle E-Business Suite account at low privilege level, confirmed by the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N - so this is NOT an unauthenticated attack, and self-service/partner accounts are enough to qualify. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector is internally consistent and worrying: AV:N/PR:L/UI:N with C:H/I:H/A:N means a low-privileged, network-reachable attacker needs nothing more than a working application account and a crafted HTTP request, which makes this highly automatable once the request shape is known. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No exact patched build number is given in the supplied data, so treat this as 'Patch available per vendor advisory': download and apply the Oracle Critical Patch Update referenced at https://www.oracle.com/security-alerts/cspusep2026.html, matching the patch to your EBS 12.2.x release level (12.2.3 through 12.2.15) and following Oracle's standard adop/Online Patching instructions - the CPU also ships prerequisite patches, so read the README before applying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today