CVE-2026-22014

LOW

Oracle User Management 12.2.7-12.2.15 - Privilege Escalation

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-22014. PoCs published by George0Papasotiriou.

AI-analyzed exploit summary This repository demonstrates a GraphQL persisted query injection vulnerability (CVE-2026-22014) where an attacker can bypass allowlisting by supplying a non-existent `queryId` alongside an arbitrary `query` parameter, leading to execution of unauthorized GraphQL queries.

Description

Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Workflow and Business Events). Supported versions that are affected are 12.2.7-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle User Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle User Management accessible data as well as unauthorized read access to a subset of Oracle User Management accessible data. CVSS 3.1 Base Score 3.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N).

Exploits (1)

nomisec WORKING POC

by George0Papasotiriou · poc

https://github.com/George0Papasotiriou/CVE-2026-22014-GraphQL-Persisted-Queries-Injection-via-ID-Manipulation

View Code ZIP pw:eip

This repository demonstrates a GraphQL persisted query injection vulnerability (CVE-2026-22014) where an attacker can bypass allowlisting by supplying a non-existent `queryId` alongside an arbitrary `query` parameter, leading to execution of unauthorized GraphQL queries.

Classification

Working Poc 98%

Attack Type

Auth Bypass

Complexity

Trivial

Reliability

Reliable

Target: GraphQL servers using persisted queries with fallback to raw query parameter (e.g., express-graphql with customExecuteFn)

No auth needed

Prerequisites: GraphQL server configured to accept persisted queries with fallback to raw `query` parameter · Network access to the GraphQL endpoint

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1078 - Valid Accounts

mistral-large-3 · analyzed Aug 04, 2026 Full analysis →

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

Oracle Advisory

https://www.oracle.com/security-alerts/cpuapr2026.html

Scores

CVSS v3 3.8

EPSS 0.0019

EPSS Percentile 9.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-284

Status published

Products (2)

oracle/user_management 12.2.7 - 12.2.15

Oracle Corporation/Oracle User Management 12.2.7 - 12.2.15

Published Apr 21, 2026

Tracked Since Apr 22, 2026