Oracle E-Business Suite CVE-2026-61006

Exploitation requires an authenticated, high-privileged Oracle E-Business Suite account (CVSS PR:H) with network HTTP access to the Process Manufacturing Logistics 'Internal Operations' component, on EBS releases 12.2.3 through 12.2.15. No user interaction is required (UI:N) and attack complexity is low (AC:L). The primary limiting factor is the high-privilege prerequisite: an attacker cannot exploit this from an unauthenticated or low-privileged position, so realistic risk is concentrated in malicious insiders or scenarios where a privileged EBS credential has already been compromised. The specific vulnerable feature, configuration, or request within Internal Operations is not disclosed by Oracle.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) shows a network-reachable, low-complexity attack requiring high privileges and no user interaction, with total impact to the module but no scope change. The high-privilege requirement (PR:H) materially lowers real-world risk versus an unauthenticated flaw: an attacker must already hold an elevated EBS account, so this is primarily an insider or post-compromise privilege/impact escalation rather than a mass-exploitable perimeter bug. No EPSS score, KEV listing, or POC was provided, so exploitation probability cannot be quantified from the input; treat exploitation likelihood as unquantified rather than low. Oracle labels it 'easily exploitable,' which aligns with AC:L, but the PR:H gate remains the dominant limiting factor. This is a real patch-priority item for EBS operators due to full module takeover potential, but not an emergency drive-by risk absent evidence of active exploitation.

A user who already holds a high-privileged Oracle EBS account (or an attacker who has phished or otherwise obtained such credentials) sends crafted HTTP requests to the Process Manufacturing Logistics Internal Operations component over the network. Because attack complexity is low and no user interaction is needed, the request drives the flaw to read, alter, and destroy module data, resulting in full takeover of OPM Logistics. No public proof-of-concept is available at time of analysis.