Oracle E-Business Suite CVE-2026-61051

Exploitation requires a valid low-privilege account on the Oracle E-Business Suite instance (CVSS PR:L confirmed). The attacker must have network access to the EBS application tier via HTTP - no adjacent network or local access limitation applies (AV:N). No user interaction by a privileged party is required (UI:N). The vulnerability resides specifically in the BI Publisher Integration component of Concurrent Processing; instances that have BI Publisher Integration disabled or that restrict Concurrent Processing access by responsibility may reduce exposure, though this is not confirmed as a complete mitigation. Attack complexity is low (AC:L), meaning no race conditions, special timing, or environmental prerequisites beyond credential possession are required. Exploitation is constrained to partial CIA impact (no full system compromise) and unchanged scope (S:U), limiting lateral movement directly from this flaw.

The CVSS 3.1 base score of 6.3 (Medium) is driven by a network attack vector, low complexity, low-privilege requirement, no user interaction, and unchanged scope - a combination that signals reliable, repeatable exploitation by any authenticated low-privilege user. EPSS data is not available in the provided intelligence, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept code has been identified, meaning exploitation remains theoretical at time of analysis. Despite its 'Medium' score, defenders should weight the PR:L requirement carefully: Oracle EBS user populations in large organizations can be in the thousands, making 'low privilege' a meaningful population of potential abusers including contractors, finance staff, and external integrators. The partial DoS component (A:L) is a further operational concern in environments where Concurrent Processing supports time-sensitive financial batch jobs. No conflicting signals were observed - CVSS vector and description are internally consistent.

An attacker holding any valid low-privilege Oracle EBS account - such as a read-only finance user, contractor, or service account - sends a crafted HTTP request to the BI Publisher Integration endpoint within Concurrent Processing. With low attack complexity and no user interaction required, the attacker can read a subset of report or job data they are not authorized to access, modify or inject data into Concurrent Processing records, or degrade service availability for batch reporting jobs. No public exploit code has been identified, but the 'easily exploitable' Oracle classification suggests exploitation does not require specialized tooling.