Oracle E-Business Suite CVE-2026-61035

Exploitation requires the attacker to already hold high application privileges within Oracle E-Business Suite (CVSS PR:H) and network HTTP access to the affected EBS web tier; the target must be running Oracle Financials for the Americas, Internal Operations component, on a version in the range 12.2.3 through 12.2.15. Per the CVSS vector, no user interaction is required (UI:N), attack complexity is low (AC:L), and scope is unchanged (S:U). The primary limiting factor is the high-privilege prerequisite, which confines realistic exploitation to trusted insiders or attackers who have already compromised a privileged EBS account rather than anonymous remote attackers; the vulnerability does not apply to versions outside the 12.2.3-12.2.15 range or to EBS instances not running this Financials module.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U) shows a network-reachable, low-complexity flaw requiring high privileges and no user interaction, producing high impact across all three security properties for a base score of 7.2 (High). The dominant limiting factor is PR:H - the attacker must already possess high privileges within the EBS application, which sharply narrows the realistic threat population to insiders or holders of compromised privileged accounts and is why the score lands at High rather than Critical despite full C/I/A impact. No EPSS score, KEV listing, or POC was provided, so there is no signal of active or imminent exploitation; the practical priority is therefore driven by patch hygiene and privileged-user trust rather than by broad opportunistic attack risk. No SSVC decision data was supplied. Note a mild tension in the source data: Oracle tags this 'Information Disclosure' yet the impact metrics and description assert full 'takeover' (C:H/I:H/A:H) - the impact metrics should be treated as authoritative over the coarse tag.

An attacker who has obtained a high-privilege Oracle EBS account - for example a malicious insider or an adversary who phished/compromised a privileged finance administrator - sends crafted HTTP requests to the Financials for the Americas Internal Operations component over the EBS web tier. Because the flaw is low-complexity and requires no user interaction, the attacker leverages their existing privileges to exceed intended authorization and take over the module, reading, altering, or destroying financial data. No public proof-of-concept is known at time of analysis, so exploitation would require independent development.