Oracle E-Business Suite CVE-2026-61114

Exploitation requires a valid low-privilege authenticated Oracle E-Business Suite account (CVSS PR:L) with network HTTP access to the EBS application tier, targeting the DB Privileges component of Oracle Application Object Library on releases 12.2.3-12.2.15; no end-user interaction is needed (UI:N). Exploitation is limited by the CVSS AC:H rating - Oracle explicitly classifies it as 'difficult to exploit', meaning the attacker must satisfy conditions outside their direct control (such as specific privilege configurations, timing, or a race in the privilege-handling logic) that will not be present in every deployment. The precise feature/configuration prerequisite is not disclosed in the Oracle CPU advisory, so the exact trigger condition is unknown; the practical limiting factors are the required authenticated account and the high attack complexity.

The signals are mixed and point to a real-but-not-emergency priority. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.5 HIGH) shows network reachability over HTTP with full triad impact, which is serious, but two metrics temper it: AC:H (Oracle explicitly calls it 'difficult to exploit', implying special conditions or timing/race elements the attacker cannot control) and PR:L (a valid low-privilege EBS account is required, so this is not an unauthenticated internet drive-by). No EPSS score, no CISA KEV listing, and no POC were provided - so there is no evidence of active exploitation or public exploit code, and no SSVC decision data is available. Overall this is a genuine escalation-to-takeover risk best treated as a standard Critical Patch Update item: prioritize for internet-facing or externally-accessible EBS instances where low-privilege accounts are broadly provisioned, but the AC:H and PR:L combination argue against treating it as a wormable or mass-exploitation threat. Missing EPSS/KEV data means real-world exploitation likelihood cannot be quantified from the input.

An attacker who has obtained or been granted a low-privilege Oracle E-Business Suite account authenticates to the EBS web tier and sends crafted HTTP requests that abuse the DB Privileges handling in the Application Object Library. By meeting the specific (difficult) conditions required, the attacker escalates from a limited application user to full takeover of AOL, gaining control over EBS security, data, and database privilege mappings. No public exploit code is identified at time of analysis, and the AC:H rating means the attacker must satisfy non-trivial preconditions rather than firing a simple one-shot request.