Oracle E-Business Suite CVE-2026-61005

Exploitation requires network access to the Oracle E-Business Suite web tier over HTTP and, per the CVSS vector (PR:L), a valid low-privileged authenticated EBS user account; no user interaction is needed and attack complexity is low against affected OPM Logistics deployments on versions 12.2.3-12.2.15. The exploit is limited to environments that have the Process Manufacturing Logistics component deployed and reachable - organizations not using OPM Logistics or that restrict web-tier access to trusted networks are not exposed. Note the unresolved conflict between the 'Authentication Bypass' tag (suggesting no auth) and PR:L (requiring auth); if Oracle confirms pre-auth exploitation, the authentication prerequisite would not apply.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) describes an easily exploitable, network-reachable flaw that needs only low privileges and no user interaction, yielding high confidentiality and integrity impact - a genuinely serious combination for an ERP holding critical business data. Oracle's own text ('Easily exploitable... low privileged attacker') reinforces the low-complexity, low-privilege reading. However, several strong-risk signals are absent: EPSS score was not provided, KEV status is not listed (no confirmed active exploitation), and no POC is referenced, so this should be treated as a high-severity-but-not-yet-demonstrably-exploited issue. Note a conflict: the intelligence tag 'Authentication Bypass' implies no credentials, yet the CVSS vector requires PR:L (an authenticated low-privilege account) - verify with Oracle whether pre-authentication exploitation is possible, as that would materially raise urgency. No availability impact (A:N) means this is a data-exposure/tampering risk rather than a service-disruption one.

An attacker who holds or phishes any low-privilege Oracle EBS account (or, if the 'Authentication Bypass' tag proves accurate, an unauthenticated attacker) sends crafted HTTP requests to the OPM Logistics component and, exploiting missing authorization checks, reads or alters manufacturing and logistics records outside their granted scope. This lets them exfiltrate all component-accessible business data and tamper with critical records such as inventory, batch, or shipment data. No public exploit code is identified at time of analysis, so an attacker would need to develop their own.