EUVD-2026-79556
GHSA-p6jg-36qj-wrmc
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP reachability but Oracle-confirmed difficult exploitation (AC:H) and a required low-privilege account (PR:L); full C/I/A takeover of the Sourcing application, scope unchanged.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Vulnerability in the Oracle Sourcing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sourcing. Successful attacks of this vulnerability can result in takeover of Oracle Sourcing. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
An attacker holding a low-privileged Oracle E-Business Suite account with network access to the Oracle Sourcing 'Internal Operations' component can take over Oracle Sourcing in supported releases 12.2.3 through 12.2.15, achieving full loss of confidentiality, integrity, and availability within that module (CVSS 3.1 base score 7.5, vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Oracle characterizes the issue as difficult to exploit (AC:H), meaning specific timing, state, or configuration preconditions must be satisfied rather than a single unauthenticated request; authentication is mandatory (PR:L) and no user interaction is required (UI:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid low-privileged Oracle E-Business Suite account with network HTTP access to the Oracle Sourcing 'Internal Operations' component on affected versions 12.2.3 through 12.2.15 (PR:L, AV:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-to-serious priority that sits below the classic pre-auth Oracle 'critical' tier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle fix for Oracle Sourcing as published in the vendor security alert at https://www.oracle.com/security-alerts/cspusep2026.html; that advisory is the authoritative source for the exact patch version and patch-set identifier, as no specific fixed build number is provided in the available data, and Oracle traditionally delivers EBS fixes through its Critical Patch Update cycle (the advisory filename cspusep2026 implies the 2026 update). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm which Oracle E-Business Suite instances run Oracle Sourcing at releases 12.2.3 through 12.2.15, and inventory every account with access to the Sourcing 'Internal Operations' component - including supplier-facing, contractor, and service accounts - disabling or narrowing any that are not strictly required; apply network-level restrictions so that only trusted internal segments and known business users can reach the Sourcing component, since exploitation requires network access plus a valid low-privileged account. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today