Oracle Order Management CVE-2026-61112

Exploitation requires a valid, low-privileged Oracle E-Business Suite user account and network-level HTTP access to the EBS application server. The specific prerequisite is access to (or the ability to reach) the Product Diagnostic Tools component within Oracle Order Management - this is the exact feature where authorization enforcement fails. The 'Authentication Bypass' tag indicates that once an attacker has minimal EBS authentication, they can bypass the component's authorization controls to read data beyond their permitted scope. Exploitation is bounded to EBS deployments running versions 12.2.3 through 12.2.15; no user interaction is required beyond the attacker's own requests. Integrity and availability are not impacted - this is strictly a read-only confidentiality breach. The primary limiting factors are the requirement for at least one valid EBS account and direct HTTP connectivity to the EBS web tier.

CVSS 3.1 scores this at 6.5 (Medium) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating straightforward network exploitation by any authenticated low-privileged user with no interaction needed. The high confidentiality impact (C:H) is significant in an ERP context where Order Management data encompasses customer records, pricing, and financial transactions. The 'Authentication Bypass' tag introduces an important caveat: if the bypass effectively allows unauthenticated access rather than merely elevating a low-privileged session, the real-world attack surface is broader than PR:L suggests - this discrepancy should be verified with Oracle's advisory. EPSS score is not available, KEV status is not listed, and no POC has been identified, so active exploitation is not confirmed. The AC:L rating confirms the exploit requires no special conditions beyond a valid account and HTTP access, making it trivially automatable within an EBS environment. Risk is moderate-to-high for organizations running EBS with external or contractor access to Order Management.

A low-privileged Oracle EBS user - such as an order entry clerk, read-only reporting account, or contractor with minimal EBS access - sends HTTP requests to the Product Diagnostic Tools endpoint within Oracle Order Management. By exploiting the authorization bypass flaw, the attacker retrieves order records, customer data, and financial information well beyond their assigned role permissions. No POC has been publicly identified, but the low attack complexity (AC:L) means exploitation requires no specialized tooling once the diagnostic endpoint path is known.