Oracle E-Business Suite CVE-2026-61113

Exploitation requires network access to the Oracle E-Business Suite HTTP tier of an affected Application Object Library instance (versions 12.2.3-12.2.15); no authentication (PR:N) and no user interaction (UI:N) are needed. The key limiting factor is high attack complexity (AC:H): the attacker must overcome conditions outside their control - likely specific configuration, session state, or timing dependencies in the authentication/access path - which is why this is not trivially exploitable against every reachable instance. Exposure is further limited to organizations running the affected 12.2.x EBS releases with the HTTP interface reachable by the attacker; the exact triggering configuration is not detailed in the source data and should be confirmed against the Oracle July 2026 CPU.

The signals are mixed and warrant prioritized-but-not-emergency handling. CVSS 3.1 base score is 7.4 (High) with an unauthenticated network vector (AV:N/PR:N/UI:N) driving severity up, but AC:H materially lowers real-world exploitability - reliable attacks require specific, hard-to-meet conditions. There is no EPSS score in the provided data, no POC, and no CISA KEV listing, so no evidence of active or automatable exploitation exists yet. Impact is limited to confidentiality and integrity (C:H/I:H) with no availability impact (A:N), consistent with data theft/tampering rather than service disruption. Because the affected product is a business-critical ERP holding sensitive financial and HR data, the potential business impact of successful exploitation is severe even though the probability signal is currently modest. Net: patch on a normal-to-expedited cycle; treat as higher priority if the environment exposes EBS to untrusted networks.

An attacker who can reach the Oracle E-Business Suite HTTP interface over the network crafts specially formed requests that bypass authentication in the Application Object Library layer, then reads or alters critical business data (e.g., financial or supplier records) without valid credentials. The high attack complexity means the attacker must satisfy specific preconditions or timing to succeed. No public exploit code is currently known, so this scenario reflects the theoretical path implied by the CVSS vector rather than a demonstrated attack.