Oracle Production Scheduling CVE-2026-61049

Exploitation requires the attacker to have access to the physical communication segment attached to the hardware where Oracle Production Scheduling runs (adjacent network, not remote/internet-facing), and requires human interaction from a person other than the attacker - a legitimate user must perform some action for the attack to succeed. No authentication is required (PR:N), so the attacker needs no valid credentials, but the attack is explicitly rated difficult (AC:H). Limiting factors: only Oracle E-Business Suite 12.2.3-12.2.15 running the Production Scheduling / Internal Operations component are affected; the adjacent-network requirement excludes purely remote internet attackers; and the mandatory victim interaction means the attack cannot be fully automated against a passive target.

Signals lean toward moderate rather than urgent priority. The CVSS 3.1 base is 7.1 (High), but the vector is dominated by mitigating factors: AV:A restricts the attacker to the adjacent/physical network segment, AC:H marks the attack as difficult to reproduce, and UI:R requires a separate human to act - a combination that materially lowers realistic exploitability despite the High CIA impacts. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified; there is no public exploit identified at time of analysis and no evidence of active exploitation. There is no conflict between the description and the CVSS vector - both consistently describe adjacent-network, interaction-dependent access. The key gaps are the missing CWE and the absent EPSS/SSVC inputs, which prevent a data-driven exploitation-likelihood estimate; treat this as an important-but-not-emergency patch, prioritized behind any internet-facing or actively-exploited EBS issues in the same Oracle Critical Patch Update.

An attacker who has gained a foothold on the same physical or adjacent network segment as an Oracle EBS Production Scheduling server crafts malicious content and waits for or lures a legitimate operator into an interaction that causes the component to process it. Because the attack is difficult to execute reliably (AC:H) and depends on that human action (UI:R), the attacker may need multiple attempts, but a successful exchange yields full takeover of the Production Scheduling component. No public exploit code is currently identified, so any near-term attack would require custom development.