EUVD-2026-79410
GHSA-7x7x-4g2x-5q9v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privileged EBS/Marketing account
-
DeliverySend crafted HTTP request to Audience component
-
ExploitExploit flaw in Oracle Marketing
-
ExecutionExecute takeover actions in application context
-
ImpactFull compromise of Marketing data and functions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the Audience component of Oracle Marketing within Oracle E-Business Suite versions 12.2.3 through 12.2.15, reachable over the network via HTTP. The decisive limiting factor is PR:H: the attacker must already possess high (administrative-level) privileges within the Oracle Marketing/EBS application - this is not remotely reachable by an anonymous user. No user interaction is required (UI:N), attack complexity is low (AC:L), and scope is unchanged (S:U). Realistic risk is therefore confined to malicious privileged insiders or attackers who have already compromised a high-privilege EBS account. |
| Impact | This is a genuinely severe technical outcome (full takeover of Oracle Marketing with C:H/I:H/A:H) but a moderate real-world priority, and the two must not be conflated. The single most important limiter is PR:H in the CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U): exploitation requires an attacker who already holds high/administrative privileges in the Oracle Marketing / E-Business Suite application, which is why the Base Score lands at 7.2 rather than near-critical despite complete confidentiality, integrity and availability impact. There is no EPSS score, no POC, and no CISA KEV listing in the provided data - so exploitation status is 'no public exploit identified at time of analysis.' Oracle's Critical Patch Update advisories (cspusep2026) characteristically provide zero technical detail and no SSVC/automatable signal, so those decision inputs are simply absent rather than favorable. Net assessment: patch on Oracle's CPU cadence, but the PR:H barrier means this is a privileged-insider / post-compromise escalation risk rather than a mass-exploitable internet-facing threat. Note also a metadata conflict: the input Tags label this 'Information Disclosure,' which contradicts the vector's I:H and A:H (full takeover) - treat the tag as inaccurate, not the impact. |
| Exploit ScenarioDerived | An attacker who has already obtained a high-privileged Oracle Marketing / EBS account (e.g., a rogue administrator or an account compromised via phishing or credential reuse) sends crafted HTTP requests to the Audience component and leverages the flaw to fully compromise the Oracle Marketing application. Because the CVSS complexity is Low (AC:L), once the privileged foothold exists the attack is described by Oracle as 'easily exploitable,' though no public POC or active exploitation is documented. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Full takeover of the Oracle Marketing module inside Oracle E-Business Suite 12.2.3 through 12.2.15 is possible through its Audience component, but only for an attacker who already holds high (administrative) privileges in the application - an anonymous remote user cannot reach it. The flaw is network-reachable over HTTP with low attack complexity and no user interaction, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base score 7.2) reflects complete loss of confidentiality, integrity, and availability for the affected module. No public exploit code has been identified and there is no confirmed active exploitation (the CVE is not in CISA KEV) at time of analysis, so the realistic threat is a malicious privileged insider or an attacker who has already compromised a high-privilege EBS account.
RemediationAI
No exact patched version is identified in the supplied data, so the primary action is to consult Oracle's security alert at https://www.oracle.com/security-alerts/cspusep2026.html and apply the Oracle E-Business Suite Critical Patch Update / security alert fix applicable to your 12.2.3-12.2.15 deployment, following Oracle's documented patching sequence for the Marketing module (applying the patch to a test instance first, since EBS marketing patches may require schema-level steps and downtime). Until the fix is applied, compensating controls should focus on the PR:H precondition, which is the factor that keeps this from being an anonymous exploit: audit and tightly limit which accounts hold high-privilege roles in Oracle Marketing/EBS, enforce strong authentication and session controls on those accounts, and monitor application logs for anomalous Audience/segmentation administration activity by privileged users. Network-level restriction - placing the EBS HTTP interface behind VPN or IP allow-listing and closing unnecessary exposure to the public internet - reduces reachable attack surface but does not address an insider abusing legitimate administrative credentials, and full mitigation of a module-takeover flaw ultimately requires the vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue sits in the Audience component of the Oracle Marketing application within Oracle E-Business Suite (EBS), the long-standing integrated ERP/CRM suite whose Marketing module manages campaign audiences, targeting lists, and segmentation data. The Audience component is exposed through the EBS application tier over HTTP, so an attacker with a valid high-privilege session can invoke the vulnerable logic across the network without any user interaction (UI:N) and with low attack complexity (AC:L). No CWE was assigned by the reporting sources, but the impact profile - high confidentiality, integrity, and availability loss with unchanged scope (S:U) - is consistent with a flaw that permits privilege escalation or unauthorized administrative actions on the module, ultimately resulting in complete takeover of the Oracle Marketing application. The decisive control on real-world risk is the CVSS privilege requirement PR:H, meaning exploitation presupposes administrative-level access inside Oracle Marketing/EBS; this constrains exposure to privileged insiders or attackers who have already obtained such an account, rather than being an unauthenticated internet-facing compromise path.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network HTTP (AV:N) and easily exploitable (AC:L) per Oracle, but a high-privileged account is required (PR:H); full application takeover yields C:H/I:H/A:H with no scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks of this vulnerability can result in takeover of Oracle Marketing. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
A high-severity flaw in the Oracle Marketing module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15) could allow an attacker with existing administrative access to that application to seize full control of the module, affecting its confidentiality, integrity, and availability. Because exploitation requires high privileges that anonymous outsiders cannot obtain, the realistic risk is a malicious insider or an adversary who has already compromised a privileged EBS account, making this a privilege-escalation and insider-threat concern rather than an external breach vector. Leadership should care because the affected module supports marketing operations and customer data, and a compromise could disrupt business processes and expose sensitive information while no vendor patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network reachability of the Oracle Marketing module, enforcing least privilege and strong authentication for high-privilege EBS accounts, monitoring and auditing administrative activity in the Audience component, and isolating or disabling the module where business operations allow.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB