Oracle E-Business Suite CVE-2026-61116

Exploitation requires only that the Oracle E-Business Suite web tier running Application Object Library 12.2.3-12.2.15 be reachable over HTTP by the attacker; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication, no user interaction, and no special client-side prerequisite. What limits exploitation is network exposure: instances that are not Internet-facing (behind VPN, internal-only, or protected by Oracle's DMZ/URL Firewall configuration) sharply reduce the attacker population, and only the affected 12.2.x version band is at risk. No non-default feature toggle is named in the description, so default-configured, network-reachable EBS installations should be assumed exploitable.

The signals are moderately concerning but not maximal. The CVSS 3.1 vector rates this 7.5 High with the most attacker-favorable exploitability metrics possible (AV:N, AC:L, PR:N, UI:N) - remote, low-complexity, unauthenticated, no user interaction - which means any exploit that emerges would be trivially reachable. However, impact is confined to confidentiality (C:H) with no integrity or availability effect, so this is a data-disclosure issue, not RCE or takeover. Mitigating the urgency: no EPSS score was provided, the CVE is not in CISA KEV (no confirmed active exploitation), and no public POC is identified - so this reads as a real but not yet weaponized priority. Internet-facing EBS instances are historically attractive targets and prior EBS AOL/core CVEs have been exploited, so the low-friction exploitation profile warrants prompt patching despite the absence of current exploitation evidence. No SSVC data was supplied. Note the input CWE is 'N/A', so the root-cause class is inferred, not confirmed.

An attacker who can reach the EBS web tier over HTTP sends a crafted request to the vulnerable Application Object Library endpoint and, because authentication/authorization is not enforced on that path, receives sensitive application data in the response without any credentials or user interaction. Given AV:N/AC:L/PR:N, this could be scripted and repeated to bulk-extract accessible data. No public POC is identified at time of analysis, so exploitation would currently require independent research.