Oracle EBS Secure Enterprise Search CVE-2026-61060

Exploitation requires a valid low-privilege account on the Oracle E-Business Suite instance with network access via HTTP to the application tier. The vulnerability resides specifically in the Search Integration Engine component of Secure Enterprise Search; exploitation is limited to data accessible through or indexed by that component. Exploitation is bounded by the unchanged scope (S:U) - the attacker cannot pivot to other system components or gain OS-level access. The primary limiting factors are: (1) a valid EBS user account must be obtained or compromised, (2) network access to the EBS HTTP application tier is required, and (3) impact is restricted to partial reads and partial writes within the SES data domain, not full database access. This vulnerability does NOT represent a fully unauthenticated external attack path against default configurations.

The CVSS 3.1 base score of 5.4 (Medium) reflects a constrained impact profile: network-reachable (AV:N), low complexity (AC:L), low privilege required (PR:L), no user interaction (UI:N), unchanged scope (S:U), with limited confidentiality and integrity impact (C:L/I:L) and no availability impact (A:N). The 'Authentication Bypass' tag creates a mild tension with the PR:L vector - if the bypass truly eliminated authentication, PR:N would be expected; the PR:L assignment is consistent with Oracle's description of 'low privileged attacker,' suggesting an authorization bypass within an authenticated session rather than a full unauthenticated attack. No EPSS data was provided, limiting probabilistic exploitation assessment. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no public POC has been identified. Real-world risk is moderate: exploitation requires a valid (even low-level) account, the data impact is partial rather than full, and Oracle EBS environments are typically not internet-exposed. However, insider threat and compromised credential scenarios elevate practical risk in enterprise deployments.

An attacker with a low-privilege EBS account - such as a general employee user - sends crafted HTTP requests to the Search Integration Engine component, exploiting the authorization bypass to query or manipulate search-indexed data beyond their permitted access level, potentially accessing restricted business records (e.g., HR or financial data indexed by SES). No public POC exists at time of analysis, but the low attack complexity (AC:L) means exploitation would not require advanced tooling once the bypass mechanism is understood.