Oracle E-Business Suite EUVD-2026-79536

The description states the initiation requirement explicitly: an unauthenticated attacker with network access via HTTP to the Oracle Application Object Library component (Core) of EBS 12.2.3-12.2.15. CVSS corroborates with AV:N, PR:N, UI:N - no credentials and no victim interaction - but also AC:H, which is the operative constraint: the attacker must satisfy an unstated condition (a specific request sequence, application state, or framework path) rather than simply sending one request. What LIMITS exploitation: the high attack complexity itself, the absence of any public exploit code, and the requirement that the EBS application tier be exposed to the attacker's network - deployments where HTTP access is confined to a trusted LAN/VPN, or where a WAF/reverse proxy fronts the tier, present a materially smaller attack surface. Availability impact is None per the vector, so denial of service is not an expected outcome, and scope is Unchanged, so the compromise is confined to the EBS instance (though the data at risk may be financial/HR-grade). No pre-authentication is required, but this is not a default-configuration one-shot: verify with Oracle whether the advisory documents a specific configuration or component state that gates the issue.

The signals here are mixed and should be weighed carefully. CVSS 3.1 gives 7.4 with AV:N/PR:N/UI:N - meaning no credentials and no victim interaction are needed - but AC:H and the vendor's own phrasing ('difficult to exploit') temper that: success depends on conditions the attacker must discover or induce, so this is not a spray-and-pray flaw. Confidentiality and Integrity are both High while Availability is None, which fits a data-tampering/data-theft primitive: an attacker who lands it can read and alter core EBS records but is not expected to crash the platform. No EPSS score, no POC indicator, and no CISA KEV listing are present in the supplied data, so there is no evidence of active exploitation; equally, absence of EPSS here is a data gap rather than proof of low likelihood. SSVC-style reading: Exploitation = none observed, Automatable = no (AC:H, condition-dependent), Technical Impact = partial (high C/I on one system, no scope change) - which lands at 'Outbreak Effort / Elevated' rather than Emergency, though for an ERP system of record the integrity impact alone justifies fast patching. Practically, any organization running EBS 12.2.x should treat the fix as a priority maintenance action rather than a weekend emergency: even a mid-sized municipal IT team in inowroclaw should treat this as urgent once the relevant Oracle patch is confirmed available, because the exposed data is financial and HR-grade. Caveats to state plainly: no EPSS value was supplied, no patch version string was supplied, and the description's 'difficult to exploit' wording is vendor-supplied and not independently verified - do not treat exploitability as either confirmed easy or confirmed impossible.

An unauthenticated remote attacker with reachable HTTP access to the EBS application tier probes the Application Object Library endpoints, identifies the condition required to trigger the flaw, and crafts a request that bypasses the authentication/authorization check rather than supplying valid credentials. Once past the AOL security layer, the attacker reads and/or writes core EBS records through the same framework that trusted sessions use, creating, modifying, or deleting critical data. The high attack complexity means this is opportunistic and requires the right target state to line up; no public exploit code was identified at time of analysis, so an attacker would most likely need to develop the technique themselves.