Oracle E-Business Suite CVE-2026-61111

Exploitation requires the attacker to have a local logon (OS-level or equivalent application session) to the infrastructure where Oracle Application Object Library executes - this is the primary limiting factor. The attacker must hold at least low-privilege credentials on the target host; unauthenticated remote exploitation is not possible per the AV:L/PR:L CVSS vector. The vulnerability affects Oracle EBS installations running AOL versions 12.2.3 through 12.2.15; versions outside this range are not confirmed affected. No special non-default configuration is stated as required - any standard EBS 12.2.3-12.2.15 deployment with the AOL Core component active appears susceptible. Factors limiting exploitation: (1) mandatory local infrastructure access eliminates remote-only attackers; (2) Oracle EBS is typically deployed in hardened, access-controlled environments with restricted shell access, reducing the insider threat surface.

The NVD CVSS 3.1 base score of 6.5 reflects a confidentiality-only impact with local attack vector and low privileges, which appropriately calibrates the raw score. Real-world risk is meaningful in EBS environments because: (1) the scope change flag indicates lateral data exposure into additional EBS modules upon successful exploitation, amplifying the effective impact; (2) low attack complexity (AC:L) and no user interaction (UI:N) mean exploitation, once local access is achieved, is straightforward; (3) the 'Authentication Bypass' tag elevates concern - bypassing authentication controls in a core EBS framework component could expose sensitive business data (HR, financials, procurement) accessible to AOL. The primary limiting factor is the local attack vector (AV:L), which requires the attacker to already have a logon to the infrastructure - this significantly narrows the realistic threat actor pool to insiders, compromised service accounts, or attackers who have already achieved initial access. No EPSS data was provided, no POC is known, and this CVE is absent from CISA KEV, suggesting no confirmed active exploitation. Risk is real but bounded by the local access prerequisite.

An attacker with a low-privileged account on the EBS application server - such as a shared service account, a developer account, or a user whose credentials were obtained through phishing - logs on locally and exploits the authentication bypass flaw in AOL Core to read data beyond their authorization level. Because the scope change is confirmed, the attacker can then access sensitive data from additional integrated EBS modules such as HR records, financial data, or procurement information. No public proof-of-concept code is known to exist at time of analysis.