CVE-2026-47031: Oracle Bills of Material Auth Bypass Flaw

CVE-2026-47031 Overview

CVE-2026-47031 is a high-severity vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite, specifically in the Bill Issues component. The flaw affects supported versions 12.2.3 through 12.2.15. An authenticated attacker with low privileges and network access via HTTP can exploit this weakness to take over the Oracle Bills of Material module. The vulnerability is classified under CWE-284 (Improper Access Control) and impacts confidentiality, integrity, and availability. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Successful exploitation results in complete takeover of Oracle Bills of Material, allowing attackers to read, modify, or destroy manufacturing bill data.

Affected Products

Oracle E-Business Suite — Oracle Bills of Material 12.2.3
Oracle E-Business Suite — Oracle Bills of Material versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Bills of Material 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-47031 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47031

Vulnerability Analysis

The vulnerability resides in the Bill Issues component of Oracle Bills of Material within Oracle E-Business Suite. An attacker only needs low-level authenticated access to the application to reach the vulnerable code path over HTTP. No user interaction is required, and exploitation complexity is low, making the flaw practical to weaponize once credentials are obtained.

Successful exploitation yields full takeover of the Oracle Bills of Material module. This includes unauthorized read access to sensitive manufacturing and product data, modification of bill-of-material records, and disruption of dependent Oracle E-Business Suite processes. Because the scope is unchanged, impact remains within the vulnerable component, but that component sits at the core of manufacturing operations for many enterprises.

The EPSS score is 0.447% as of 2026-07-23, reflecting low observed exploitation activity at publication.

Root Cause

The underlying weakness is Improper Access Control ([CWE-284]). Authorization checks in the Bill Issues component do not sufficiently restrict what actions a low-privileged authenticated user can perform. This allows an attacker to invoke functionality reserved for higher-privileged roles.

Attack Vector

The attack vector is network-based over HTTP. The attacker authenticates to the Oracle E-Business Suite web tier with any valid low-privilege account, then submits crafted requests to the Bill Issues functionality. Oracle has not published exploit details, and no public proof-of-concept is available. Refer to the Oracle Security Alert July 2026 for vendor guidance.

Detection Methods for CVE-2026-47031

Indicators of Compromise

Unexpected modifications to Bills of Material records by accounts that historically only read data.
HTTP requests from low-privileged E-Business Suite users targeting Bill Issues endpoints outside normal business patterns.
Anomalous session activity on the E-Business Suite application tier, such as elevated request rates from a single authenticated user.

Detection Strategies

Review Oracle E-Business Suite application audit logs (FND_LOG_MESSAGES, sign-on audit) for privilege use anomalies tied to Bills of Material responsibilities.
Inspect web tier access logs for repeated POST requests to Bill Issues URLs from the same authenticated session.
Correlate database change logs on BOM_* tables with the user responsibility that made the change to identify mismatches.

Monitoring Recommendations

Enable Oracle E-Business Suite Sign-On Audit at the FORM level for the Bills of Material responsibility.
Forward E-Business Suite application and Apache/OHS logs to a centralized log platform for behavioral analysis.
Baseline normal Bills of Material transaction volumes per user and alert on statistically significant deviations.

How to Mitigate CVE-2026-47031

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15.
Audit user accounts that hold Bills of Material responsibilities and remove unnecessary access.
Restrict network exposure of the E-Business Suite application tier so that only trusted networks can reach HTTP endpoints.

Patch Information

Oracle addressed CVE-2026-47031 in the July 2026 Critical Patch Update. Administrators should download and apply the fix documented in the Oracle Security Alert July 2026. Verify the patch level using adop -status and confirm the Bills of Material module version after deployment.

Workarounds

Temporarily disable or restrict the Bill Issues functionality for low-privileged responsibilities until the patch is applied.
Place the E-Business Suite web tier behind a web application firewall and block anomalous requests to Bill Issues endpoints.
Enforce strong authentication and session controls to reduce the risk of low-privileged credential compromise.

bash

# Verify Oracle E-Business Suite patch level after applying the July 2026 CPU
adop -status
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('CPUJUL2026')
 ORDER BY last_update_date DESC;
EOF