Oracle E-Business Suite CVE-2026-61009

Exploitation requires the attacker to already hold high privileges within Oracle E-Business Suite (CVSS PR:H) and network access to the EBS application over HTTP (AV:N); no end-user interaction is needed (UI:N). Limiting factors are significant: high attack complexity (AC:H) implies conditions outside the attacker's direct control or a non-trivial preparatory/timing requirement, and the high-privilege prerequisite means only an authenticated, elevated EBS user (or an attacker who has already stolen such credentials) can attempt it. Only supported versions 12.2.3 through 12.2.15 of Oracle Process Manufacturing Logistics are in scope. Oracle's description does not name a specific toggle or non-default feature, so the primary gate is the privilege level and the difficult exploitation conditions rather than an optional configuration.

The signals point to a genuine but constrained risk. The CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H, base 8.0) shows network reachability but two strong dampeners: high attack complexity (AC:H) and a requirement for high privileges (PR:H), meaning the attacker must already be an authenticated, highly privileged EBS user and overcome non-trivial conditions. The 8.0 score is inflated largely by the scope change (S:C) and full triple-impact. No EPSS score, KEV listing, POC, or SSVC decision data was supplied, so exploitation probability cannot be quantified from the input; the absence of KEV/POC indicates no observed active exploitation at this time. This is a patch-in-normal-cycle priority for most organizations rather than an emergency, but the scope-change potential to affect additional Oracle products warrants prompt remediation in environments where many users hold elevated EBS privileges. Note: EPSS and SSVC data are missing - real-world exploitation likelihood is inferred, not measured.

A malicious insider or an attacker who has compromised a highly privileged Oracle EBS account sends crafted HTTP requests to the Process Manufacturing Logistics module, chaining the difficult-to-exploit condition to take over the module and, via the scope change, reach and impact additional Oracle products in the EBS stack. No public exploit code is known, so the attacker would need to independently develop the technique against a non-trivial (AC:H) flaw.