Oracle Inventory Management CVE-2026-61028

Exploitation requires three concurrent conditions: (1) the attacker must have a high-privilege account with local logon access (AV:L/PR:H) to the infrastructure host where Oracle Inventory Management executes - remote network exploitation is not possible; (2) the attack complexity is rated High (AC:H), meaning specific and non-trivial conditions must align, likely involving race conditions, timing, or specific system state not reliably reproducible on demand; (3) the affected installation must be running Oracle E-Business Suite 12.2 within versions 12.2.3 through 12.2.15. The limiting factors - local access only, high existing privilege requirement, and high complexity - collectively mean that a threat actor would need to already be a trusted insider or have achieved deep prior compromise before this vulnerability becomes exploitable. Standard network perimeter controls and PAM/privileged access restrictions entirely eliminate external threat actor risk.

This vulnerability carries a CVSS 3.1 base score of 1.9, placing it at the very bottom of the severity spectrum. The vector (AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L) compounds multiple limiting factors: the attacker must already have high privileges on the local infrastructure, must overcome high attack complexity, and the resulting impact is only a partial availability disruption with no data exposure or integrity violation. No EPSS data was provided, but given the extreme constraints, exploitation probability would be expected to be negligible. KEV status is not applicable - no CISA active exploitation listing exists. No POC code has been identified. The real-world priority for this CVE is very low; it does not represent a meaningful threat in environments with standard access controls, since any attacker already possessing the required local high-privilege access would likely have more impactful attack paths available. Missing data: EPSS score is absent from the provided intelligence; affected CPE strings are not formally provided beyond version range text.

A database administrator or system operator with an existing high-privileged local OS account on the EBS application server attempts a specific sequence of operations - the exact nature of which Oracle has not disclosed - against the Internal Operations component under conditions of high attack complexity, resulting in a transient or partial degradation of Oracle Inventory Management availability. No public exploit code exists to facilitate this scenario.