Description
Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contracts Integration. While the vulnerability is in Oracle Contracts Integration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Contracts Integration. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
Published: 2026-07-21
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in Oracle Contracts Integration, a component of Oracle E‑Business Suite, and allows a low‑privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to a full takeover of Oracle Contracts Integration, affecting confidentiality, integrity, and availability. The flaw also carries a scope change, meaning attacks may influence additional related products, amplifying the potential damage.

Affected Systems

The affected product is Oracle Contracts Integration. Supported releases from version 12.2.3 through 12.2.15 are affected.

Risk and Exploitability

The CVSS 3.1 base score is 8.5, indicating a high‑severity vulnerability. The EPSS score is less than 1 %, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is network‑based through the HTTP interface, requiring only low‑privilege credentials and no user interaction. Although exploitation is difficult, the potential impact is severe, warranting immediate assessment and mitigation once a patch is issued.

Generated by OpenCVE AI on August 2, 2026 at 23:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor patch for Oracle Contracts Integration as soon as it is released.
  • Limit network access to Oracle Contracts Integration by restricting traffic to trusted IP ranges or implementing a firewall rule.
  • Enable and regularly review audit logs for unauthorized access attempts or anomalous behavior.

Generated by OpenCVE AI on August 2, 2026 at 23:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 01 Aug 2026 07:00:00 +0000

Type Values Removed Values Added
Title Low‑Privileged HTTP Attack Can Takeover Oracle Contracts Integration

Mon, 27 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Title Low‑Privilege Remote Takeover via HTTP in Oracle Contracts Integration

Fri, 24 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Title Low‑Privilege Remote Takeover via HTTP in Oracle Contracts Integration

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contracts Integration. While the vulnerability is in Oracle Contracts Integration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Contracts Integration. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
First Time appeared Oracle
Oracle contracts Integration
CPEs cpe:2.3:a:oracle:contracts_integration:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle contracts Integration
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Oracle Contracts Integration
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T17:07:10.232Z

Reserved: 2026-05-18T15:55:10.318Z

Link: CVE-2026-47033

cve-icon Vulnrichment

Updated: 2026-07-23T16:16:06.387Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T00:00:04Z

Weaknesses