Oracle Production Scheduling CVE-2026-61050

Exploitation requires the attacker to hold a valid low-privileged authenticated account on the Oracle E-Business Suite instance, as confirmed by PR:L in the CVSS vector - anonymous or unauthenticated access is not sufficient. Network access to the application via HTTP is required (AV:N). High-complexity conditions (AC:H) must be met - Oracle characterizes this as 'difficult to exploit'; the specific technical trigger is undisclosed but likely involves precise request sequencing, session state manipulation, or a particular application configuration state within the Production Scheduling UI. The Oracle Production Scheduling module must be deployed and accessible within the EBS instance - not all EBS deployments include this module, and it must be network-reachable from the attacker's position. No victim user interaction is required (UI:N). Limiting factors: the AC:H rating significantly reduces opportunistic mass exploitation; mandatory pre-existing authenticated access eliminates anonymous Internet-facing attacks; scope is contained to the Production Scheduling UI component and does not affect all EBS modules or the broader EBS platform.

The CVSS 3.1 base score of 5.3 (Medium) is meaningfully suppressed by AC:H (high attack complexity), which limits real-world exploitability despite C:H indicating complete confidentiality loss. PR:L requires the attacker to already hold a valid low-privileged account, adding a significant barrier that rules out anonymous Internet-sourced attacks. The 'Authentication Bypass' tag creates minor tension with PR:L in the CVSS vector - this likely indicates the vulnerability bypasses authorization controls for data beyond the attacker's privilege tier rather than bypassing initial authentication entirely; this distinction is inferred, not vendor-confirmed. No EPSS score was provided in the available intelligence, so statistical exploitation probability cannot be quantified. The vulnerability is absent from the CISA KEV catalog and no public exploit code has been identified, indicating no evidence of active opportunistic exploitation at time of analysis. The high-complexity exploitation requirement further constrains mass exploitation scenarios. Real-world risk is moderate for organizations running Oracle EBS with the Production Scheduling module deployed, particularly in manufacturing or operations environments where production plans and schedules represent sensitive business data; the pre-authentication account requirement limits the primary threat vector to insider threat or post-compromise lateral movement rather than external opportunistic attack.

A low-privileged EBS user - such as a factory floor operator or read-only production planner - sends a specially crafted HTTP request to the Oracle Production Scheduling User Interface under the specific conditions required by AC:H, exploiting a flaw in the application's authorization enforcement layer. The attacker bypasses data-level access controls governing the Production Scheduling module and gains full read access to all accessible data, including potentially sensitive production plans, schedules, capacity data, and operational records belonging to other business units or access tiers. No public exploit code has been identified, so exploitation likely requires custom tooling and familiarity with the Oracle EBS Production Scheduling application's internal request structure and session handling.