CVE-2026-22014

CVE-2026-22014 is a vulnerability in the Oracle User Management component of Oracle E-Business Suite, affecting versions 12.2.7 through 12.2.15. The flaw exists within the Workflow and Business Events functionality and enables unauthorized data access and modification by high-privileged attackers. This represents a moderate risk to organizations running affected versions of Oracle E-Business Suite. The vulnerability has a CVSS 3.1 base score of 3.8 (LOW severity) with a network-based attack vector that requires high privilege credentials and no user interaction. Successful exploitation allows attackers to read a subset of User Management data and perform unauthorized updates, insertions, and deletions to accessible data. The low attack complexity indicates the vulnerability is straightforward to exploit by those with the necessary privileges. There is currently no evidence of active exploitation in the wild. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities list, and community attention remains minimal based on the EPSS score of 0.00023. Organizations should prioritize patching based on asset criticality rather than immediate threat response, though timely remediation is still recommended to prevent potential abuse by insider threats or compromised high-privilege accounts.