Oracle Inventory Management CVE-2026-61014

Exploitation requires network HTTP access to an Oracle E-Business Suite deployment running Inventory Management on versions 12.2.3-12.2.15 with the Internal Operations component in use, and - per the CVSS vector PR:L - a valid low-privileged authenticated EBS account (no admin rights, no user interaction). What limits exploitation: the attacker must already hold credentials to the EBS instance and be able to reach the application over the network, so instances restricted to internal/VPN access and with tight user provisioning are materially harder to attack; versions outside 12.2.3-12.2.15 are not listed as affected. Note the 'Authentication Bypass' tag would imply no credentials are needed, which conflicts with PR:L - resolve this with Oracle before assuming unauthenticated reachability.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N = 7.7) signals a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high confidentiality impact and a scope change - a realistic risk for internet- or intranet-exposed EBS instances that hold sensitive supply-chain, financial, and PII data. However, the impact is confidentiality-only (I:N/A:N): no data tampering or availability loss, which bounds the worst case to disclosure. No EPSS score was provided, no POC is identified, and the vulnerability is not in CISA KEV, so there is currently no evidence of active or automatable exploitation - this reads as a high-CVSS issue that is a genuine priority for EBS operators but not yet a confirmed in-the-wild threat. A material caveat: the 'Authentication Bypass' tag implies unauthenticated access, yet the CVSS vector specifies PR:L (a low-privileged authenticated attacker); these signals conflict, so treat the auth requirement per the CVSS vector (authenticated) and verify with Oracle. SSVC-style read: exploitation=none observed, automatable=unknown, technical impact=partial (confidentiality only).

A low-privileged employee or a compromised standard EBS account authenticates to the Inventory Management web interface over HTTP and issues crafted requests to the Internal Operations component to read inventory, procurement, and related records beyond their authorization, with the scope change letting them reach data belonging to other EBS modules. Because attack complexity is low and no user interaction is needed, the action is straightforward for anyone with valid low-tier credentials; no public exploit code has been identified at time of analysis.