Oracle E-Business Suite CVE-2026-61020

Exploitation requires a valid low-privileged authenticated account on the Oracle E-Business Suite instance (CVSS PR:L) with network HTTP access to the Oracle Customers Online module of the Internal Operations component, on versions 12.2.3 through 12.2.15; no user interaction and no elevated privileges are needed (UI:N, AC:L). Limiting factors that reduce real-world risk: the attacker must first obtain some EBS credentials or a foothold account (it is not fully unauthenticated despite the 'Authentication Bypass' tag), the instance must run an affected 12.2.x version, and exposure shrinks significantly if the application tier is not reachable from untrusted networks. There is no impact to availability (A:N), so this is a data confidentiality/integrity risk rather than a denial-of-service condition.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1) describes a high-severity, low-complexity, network-reachable flaw needing only low privileges and no user interaction - a realistic priority for any internet- or intranet-exposed EBS instance because a single low-tier account yields full read/write over Customers Online data. No EPSS score, KEV listing, or POC was provided, so exploitation is currently theoretical: this is a high-CVSS issue without confirmed active exploitation. Weighing signals, the ease of exploitation (AC:L/PR:L/UI:N) and the sensitivity of customer data make it worth prioritizing, but the absence of KEV and EPSS data means it is not yet demonstrably being weaponized - treat as high-priority patching, not emergency incident response. Note a mild tension: the 'Authentication Bypass' tag could be read as unauthenticated, yet the CVSS vector explicitly requires PR:L (a valid low-privileged account); the vector should be trusted over the tag, and the 'bypass' most likely refers to bypassing authorization boundaries, not authentication entirely.

A low-privileged EBS user (for example, an internal employee or a compromised self-service account) authenticates to the application tier and sends crafted HTTP requests to Customers Online functionality that fails to enforce authorization, allowing them to read and alter customer master data beyond their assigned scope. Given AC:L and no user interaction, the requests are straightforward to repeat and script once the authorization gap is understood; no public POC is currently known.