Oracle Inventory Management CVE-2026-61023

Exploitation requires direct logon to the infrastructure host where Oracle Inventory Management executes - this is a local (AV:L) attack vector, ruling out remote unauthenticated exploitation. The attacker must hold high-level privileges (PR:H), consistent with an OS administrative account or an EBS application-tier privileged user such as applmgr or oracle. Attack complexity is rated High (AC:H), meaning specific environmental conditions or a non-trivial sequence of steps must be satisfied beyond mere credential possession - the exact technical condition is not disclosed by Oracle (no CWE assigned). Exploitation is limited to Oracle E-Business Suite versions 12.2.3 through 12.2.15. External or unauthenticated network-based exploitation is not possible given AV:L. The primary limiting factors are: the requirement for prior local infrastructure access, the need for high OS/application privileges, and the high complexity of the exploit itself.

The CVSS 3.1 base score of 6.4 (Medium) reflects a meaningful set of attacker preconditions: local infrastructure access (AV:L), high privilege level (PR:H), and high attack complexity (AC:H). All three of these constraints must be simultaneously satisfied, which substantially limits the realistic attacker population to insiders, compromised privileged accounts, or attackers already holding deep footholds within the EBS host environment. Despite this, the impact is maximal (C:H/I:H/A:H) - successful exploitation results in full takeover of the Oracle Inventory Management instance, including confidentiality, integrity, and availability. No EPSS score was provided in the source data, so exploitation probability cannot be quantified independently. There is no CISA KEV listing and no reported POC, suggesting this is not currently being exploited at scale. The tag 'Information Disclosure' alongside the full-takeover impact rating may indicate the vector includes exfiltration of inventory and supply chain data as a primary attacker objective. Overall, this is a real but operationally constrained risk: organizations should prioritize patching in environments with shared privileged access or weak separation between EBS application tiers and OS-level accounts.

An insider or an attacker who has already compromised a high-privileged account (such as an OS-level applmgr or DBA account) on the EBS application server navigates to a condition exploitable through the Internal Operations component, leveraging the required elevated privileges and satisfying the high-complexity prerequisite. Successful exploitation results in full control of the Oracle Inventory Management instance, potentially enabling exfiltration of supply chain and inventory data or manipulation of operational records. No public exploit code is known at time of analysis.