EUVD-2026-79556
GHSA-p6jg-36qj-wrmc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege EBS account
-
DeliveryReach Sourcing Internal Operations over HTTP
-
ExploitSatisfy difficult exploit preconditions
-
ExecutionTrigger vulnerability in component
-
ImpactTake over Oracle Sourcing (C/I/A)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged Oracle E-Business Suite account with network HTTP access to the Oracle Sourcing 'Internal Operations' component on affected versions 12.2.3 through 12.2.15 (PR:L, AV:N). Exploitation is explicitly rated 'Difficult' by Oracle (AC:H), indicating non-trivial preconditions such as specific timing, state, or configuration must be met - it is not a single-request unauthenticated compromise. Limiting factors: authentication is mandatory (no PR:N pre-auth path), no user interaction is needed (UI:N), scope is unchanged (S:U, confined to Sourcing), and the AC:H barrier materially reduces reliable weaponization. |
| Impact | This is a moderate-to-serious priority that sits below the classic pre-auth Oracle 'critical' tier. The CVSS 3.1 base score is 7.5 with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - network-reachable over HTTP and yielding full compromise (C:H/I:H/A:H, described as 'takeover of Oracle Sourcing'), but meaningfully gated by two limiters: AC:H (Oracle explicitly calls it 'Difficult to exploit') and PR:L (a valid low-privileged EBS account is required). Those two factors are why the score lands at 7.5 rather than the 9.8/9.9 seen in pre-auth EBS/Fusion Middleware siblings. No EPSS score, no CISA KEV entry, and no public POC are present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis' - there is no evidence of active or automatable exploitation. The Oracle advisory (cspusep2026) provides zero technical detail, consistent with Oracle's CPU practice, so the exact mechanism is opaque. Net: patch during the normal Oracle CPU cycle and prioritize where the EBS Sourcing module is internet-exposed, but this is not a drop-everything pre-auth wormable bug. Note one data conflict: the 'Information Disclosure' tag understates a full-triad takeover (C:H/I:H/A:H), and CWE is N/A so no weakness class is confirmed. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged Oracle E-Business Suite account (e.g., a self-registered supplier or internal user) sends a series of crafted HTTP requests to the Oracle Sourcing 'Internal Operations' component and, after satisfying the difficult (AC:H) preconditions, escalates to full compromise of the Sourcing application - reading, altering, and disrupting all Sourcing data. No public exploit code is identified, and the AC:H rating implies the attack requires specific timing, configuration, or multi-step conditions rather than a single trivial request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
An attacker holding a low-privileged Oracle E-Business Suite account with network access to the Oracle Sourcing 'Internal Operations' component can take over Oracle Sourcing in supported releases 12.2.3 through 12.2.15, achieving full loss of confidentiality, integrity, and availability within that module (CVSS 3.1 base score 7.5, vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Oracle characterizes the issue as difficult to exploit (AC:H), meaning specific timing, state, or configuration preconditions must be satisfied rather than a single unauthenticated request; authentication is mandatory (PR:L) and no user interaction is required (UI:N). There is no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV), so the practical risk is a moderate-to-serious patching priority rather than an emergency pre-auth compromise scenario.
RemediationAI
Apply the Oracle fix for Oracle Sourcing as published in the vendor security alert at https://www.oracle.com/security-alerts/cspusep2026.html; that advisory is the authoritative source for the exact patch version and patch-set identifier, as no specific fixed build number is provided in the available data, and Oracle traditionally delivers EBS fixes through its Critical Patch Update cycle (the advisory filename cspusep2026 implies the 2026 update). If patching cannot be completed promptly, note that exposure requires an authenticated low-privileged account with network access to the Sourcing 'Internal Operations' component, so effective compensating controls are: restrict network reachability to the Sourcing HTTP endpoints so only trusted administrative or procurement networks can connect (side effect: remote and partner users lose access unless routed through a VPN or reverse proxy); audit and strip unnecessary EBS responsibilities, roles, and self-service accounts so that the population able to reach Sourcing with low privileges is minimized (side effect: legitimate procurement staff may need role re-provisioning); and enable database and application audit logging for Sourcing internal operations to detect anomalous access patterns (side effect: increased log volume and storage/performance overhead). Because exploitation is rated Difficult (AC:H) and no public exploit code has been identified, staged patching within a normal monthly cycle is defensible, but the fix should not be indefinitely deferred given the full confidentiality, integrity, and availability impact on Sourcing data. Validate the patch by confirming the affected Sourcing component is updated on all application tier nodes, since EBS deployments frequently comprise multiple application servers that must be patched consistently.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Sourcing is the procurement and negotiation module of Oracle E-Business Suite (EBS), a multi-tier Java/Oracle Database application whose business logic is exposed through HTTP(S) to authenticated users. The vulnerable component is identified as 'Internal Operations', an internal-facing portion of the Sourcing module reached over HTTP; the CVSS vector confirms network reachability (AV:N), low-privilege authentication (PR:L), no user interaction (UI:N), and unchanged scope (S:U), meaning the attacker escalates within Sourcing's own trust boundary rather than pivoting directly into another EBS component under the vector's assumptions. Full C:H/I:H/A:H impacts indicate the flaw permits reading, modifying, and disrupting Sourcing data and functionality with privileges beyond the attacker's intended role. No CWE identifier was supplied for this CVE, so the precise root-cause class (for example authorization bypass, insecure direct object reference, or privilege management error) is not confirmed from the available data; the combination of PR:L with a complete confidentiality/integrity/availability loss is most consistent with a broken access-control or privilege-escalation class defect, but this should be treated as an inference rather than a vendor-confirmed categorization. The AC:H rating is the key technical qualifier: exploitation is explicitly rated 'Difficult' by Oracle, implying non-trivial preconditions such as particular application state, timing windows, or configuration rather than a trivially repeatable request.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP reachability but Oracle-confirmed difficult exploitation (AC:H) and a required low-privilege account (PR:L); full C/I/A takeover of the Sourcing application, scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Sourcing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sourcing. Successful attacks of this vulnerability can result in takeover of Oracle Sourcing. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle E-Business Suite customers running Oracle Sourcing releases 12.2.3 through 12.2.15 face a high-severity weakness that allows an already-authenticated user with only low-level privileges to seize control of the Sourcing module, resulting in complete loss of confidentiality, integrity, and availability of the sourcing data and workflows within it. Because no vendor patch is currently available, procurement, sourcing, and supplier-negotiation processes - and the pricing, contract, and supplier data they contain - remain exposed until Oracle releases a fix or interim controls are in place. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so leadership should treat this as a managed, time-bound remediation priority rather than an emergency.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to the Oracle Sourcing 'Internal Operations' component to trusted internal segments only; aggressively reduce and re-review all accounts with Sourcing access, eliminating unnecessary low-privileged and shared credentials; enforce least privilege and separation of duties across Sourcing roles; enable detailed auditing, logging, and alerting on Sourcing configuration and administrative changes; require strong authentication (MFA where supported via surrounding infrastructure) for Sourcing users; and maintain heightened monitoring of Sourcing activity until a vendor fix is applied.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB