Oracle Contracts EUVD-2026-79769

Requires an attacker who already holds high application privileges (PR:H) on an Oracle E-Business Suite deployment running Oracle Contracts version 12.2.14 or 12.2.15, with network reachability to the Contracts Internal Operations component over HTTP. No user interaction is needed (UI:N) and the vector is network-based (AV:N) with low complexity (AC:L), but the high-privilege prerequisite is the primary limiting factor - this cannot be exploited by an unauthenticated or low-privileged actor. Deployments on unaffected versions or without network exposure of the EBS web tier to the attacker are not at risk.

This is a genuine but privilege-gated issue, not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 7.2 High) is well-calibrated: the full C:H/I:H/A:H triad and 'takeover' language justify High severity, but the PR:H requirement (attacker must already hold high/administrative privileges in the application) is the dominant risk limiter and is what caps the score at 7.2 rather than the 9.8/10.0 seen for pre-auth siblings in the same September 2026 Oracle CPU. No EPSS score, no KEV listing, and no known POC are present in the input, so there is no signal of active or imminent exploitation - exploitation status is best described as no public exploit identified. There is no SSVC data supplied. The signals are internally consistent (no CVSS-vs-description conflict): the description's 'high privileged attacker with network access via HTTP' matches PR:H/AV:N exactly. Net: treat as a legitimate patch-cycle priority for organizations running the affected Oracle Contracts versions, but the PR:H barrier means realistic risk is post-authentication privilege abuse / insider or chained-attack territory rather than mass internet exploitation.

An attacker who already possesses high-privilege application credentials on an Oracle E-Business Suite Oracle Contracts instance (e.g., a rogue administrator, or an outside attacker who has stolen/chained their way into a privileged account) sends crafted HTTP requests to the Internal Operations component. The flaw allows full compromise - read, modify, and destroy Contracts data and disrupt availability. No public exploit code is identified at time of analysis, and the PR:H requirement makes this a plausible insider or post-compromise escalation scenario rather than an unauthenticated internet attack.