Oracle E-Business Suite CVE-2026-61027

Exploitation requires an authenticated attacker holding high privileges (CVSS PR:H) within Oracle E-Business Suite who can reach the Inventory Costing functionality of the Cost Management module over HTTP (AV:N). Limiting factors: the attacker must already possess high application privileges, so this is not exploitable by anonymous or low-privileged users; however, no user interaction is needed (UI:N), attack complexity is low (AC:L), and it affects default deployments of the listed 12.2.3-12.2.15 versions once such privilege is held. It is confined to a single security scope (S:U), so it does not by itself cross into other systems.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 7.2 High) shows the decisive limiting factor is PR:H - the attacker must already hold high privileges within the application. Attack complexity is low and no user interaction is required, so once that privilege is held, exploitation is described by Oracle as 'easily exploitable.' No EPSS score, SSVC decision, KEV listing, or POC was provided in the intelligence, so there is no evidence of active or automatable exploitation; the practical risk is dominated by insider or credential-compromise scenarios rather than mass remote attack. This is a genuine 'takeover' impact but gated behind existing high privilege, making it a meaningful patch-cycle priority for exposed EBS environments rather than an emergency drop-everything issue. Note the vendor 'Information Disclosure' tag understates the vector, which asserts full C/I/A impact and complete module takeover - treat the CVSS impact as authoritative over the tag.

An attacker who has obtained a high-privileged Oracle E-Business Suite account - whether a malicious insider or an outsider who phished or credential-stuffed an administrator - sends crafted HTTP requests to the Inventory Costing functions of the Cost Management module. With low attack complexity and no user interaction required, they escalate to full control of the module, reading and altering costing data or rendering it unavailable. No public POC or exploit code was identified at the time of analysis.