Oracle E-Business Suite CVE-2026-61031

Exploitation requires network access to the Oracle E-Business Suite application tier over HTTP and a valid low-privilege authenticated account (CVSS PR:L), targeting the Internal Operations component of the Financials Common Country product on affected versions 12.2.3 through 12.2.15. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker must already possess or obtain low-level EBS credentials and must be able to reach the EBS web tier, so environments that restrict EBS to internal networks and enforce least-privilege responsibilities materially reduce exposure. Note the input's 'Authentication Bypass' tag contradicts Oracle's PR:L vector; the vendor vector (authentication required) should govern defensive decisions.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1) describes an easily exploitable, network-reachable flaw requiring only low privileges and no user interaction, yielding high confidentiality and integrity impact. This is a genuine priority for organizations running EBS because ERP data is business-critical, but several risk-amplifying signals are absent: no EPSS score was provided, the CVE is not in CISA KEV, and no POC or exploit code was identified, so there is no evidence of active or imminent widespread exploitation. Note a conflict in the input: the 'Authentication Bypass' tag implies no credentials are needed, whereas Oracle's PR:L vector requires an authenticated low-privilege account - the authoritative Oracle vector should be trusted, meaning exploitation presupposes some valid access. No SSVC decision data was supplied, so automatability and exploitation status cannot be independently characterized beyond the CVSS metrics.

An attacker who holds or phishes a low-privilege EBS user account sends crafted HTTP requests to the Internal Operations functionality of Oracle Financials Common Country and, because access controls are insufficient, reads and alters financial data outside their authorized scope. Given AC:L and UI:N, the attack is straightforward and requires no victim interaction, though a valid low-privilege session is a prerequisite. No public POC was identified at time of analysis.