Oracle E-Business Suite CVE-2026-61107

Exploitation requires the attacker to already hold high-level privileges within Oracle E-Business Suite (CVSS PR:H) - specifically administrative access to the Oracle Applications DBA product - and network reachability to the EBS application tier over HTTP (AV:N). No user interaction is needed (UI:N) and attack complexity is low (AC:L), so the operation is straightforward once the privilege and network prerequisites are satisfied. The limiting factors are the mandatory pre-existing high privileges and exposure being confined to supported versions 12.2.3-12.2.15; instances where DBA-level access is tightly controlled and the HTTP tier is network-segmented sharply reduce realistic exploitability.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2) describes a network-reachable, low-complexity attack that nonetheless requires high existing privileges (PR:H) - the single most important mitigating factor, since the attacker must already hold elevated administrative rights within EBS. The full C:H/I:H/A:H triad and Oracle's own 'takeover' language make the technical impact total once those privileges are held. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified; the absence of KEV and public exploit code, combined with the PR:H barrier, suggests this is a real but privilege-gated priority rather than a mass-exploitable internet threat. Note a tension in the source data: the tags label this 'Information Disclosure,' but the vector and description assert full C/I/A takeover - treat the impact as full compromise per the CVSS vector and verify scope with the Oracle CPU advisory.

An attacker who has already obtained a high-privileged Oracle Applications DBA account - for example a compromised administrator credential or a malicious insider - sends crafted HTTP requests to the Internal Operations component of an EBS 12.2.x instance. Leveraging the flawed operation, they escalate to full control of the Applications DBA product, reading and altering data and disrupting availability. No public POC is known, and the low attack complexity (AC:L) means the operation itself is reliable once the privilege prerequisite is met.