Oracle E-Business Suite CVE-2026-61110

Exploitation requires (1) network HTTP access to the Oracle E-Business Suite application tier where the Oracle Applications DBA / ADPatch component is reachable, and (2) an existing low-privileged authenticated account on the EBS instance (CVSS PR:L - this is NOT unauthenticated). No user interaction is required (UI:N) and attack complexity is low (AC:L). The affected deployment must run a supported EBS release in the 12.2.3-12.2.15 band. Limiting factors that reduce realistic risk: the attacker must already possess valid EBS credentials, and instances whose application tier and AD tooling are not exposed to broad or untrusted networks substantially shrink the reachable attacker population.

The signals are moderately strong but partly one-sourced. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U) describes a network-reachable, low-complexity attack needing only low privileges and no user interaction, with high impact across all three security properties - a realistic candidate for opportunistic abuse by any authenticated EBS user. However, no EPSS score, SSVC decision, KEV entry, or POC was provided, so exploitation probability cannot be quantified. It is NOT confirmed actively exploited and no public exploit is identified at time of analysis, which tempers urgency relative to a KEV-listed flaw. Note also a mild internal tension: Oracle tags this 'Information Disclosure' while the vector asserts full C/I/A takeover - treat the tag as a coarse category, not a limit on impact, and rely on the vector. Net: a genuine high-priority patch item for internet- or intranet-exposed EBS instances with many user accounts, but not a drop-everything zero-day given the absence of exploitation evidence.

An attacker who holds any low-privileged Oracle E-Business Suite account (for example a routine self-service or functional user, or a compromised employee credential) sends crafted HTTP requests to the ADPatch/Applications DBA functionality over the application tier. With no user interaction and low attack complexity, the request escalates the attacker's control into a takeover of the Applications DBA component, granting full read/write and disruption capability. No public exploit code is currently identified, so this would require original exploit development.