Oracle E-Business Suite CVE-2026-61138

Exploitation targets the Internal Operations component of the Oracle CMRO module within an Oracle E-Business Suite 12.2.3-12.2.15 deployment that is reachable over HTTP; the attacker needs no account (PR:N) and no user interaction (UI:N). What LIMITS exploitation is the High attack complexity (AC:H): the vendor rates this 'difficult to exploit,' implying dependence on specific conditions, timing, or configuration of the CMRO/EBS environment rather than a trivially repeatable request, and the target organization must actually have the CMRO module installed with its Internal Operations endpoints network-accessible. Integrity impact is only partial (I:L) and there is no availability impact, so the realistic outcome is primarily unauthorized data disclosure with limited write access, not full compromise or denial of service.

The signals are mixed and should temper the 7.5 'High' headline. On the elevating side: attack vector is network (AV:N), no privileges are required (PR:N), no user interaction is needed (UI:N), the scope changes (S:C), and confidentiality impact is High (C:H) - an appealing profile for data theft. On the moderating side: attack complexity is High (AC:H), meaning special conditions or non-trivial effort are required, and integrity impact is only Low (I:L) with no availability impact (A:N). No EPSS score was provided in the input, so exploitation probability cannot be quantified. It is NOT in CISA KEV and no POC was supplied, so there is no evidence of active or imminent exploitation. Net: this is a legitimate item to fix within the normal CPU cycle for organizations actually running the CMRO module, but the High attack complexity and absence of KEV/POC/EPSS data argue against emergency out-of-band response. One data caveat: the vendor tag says 'Authentication Bypass' while the CWE is N/A - that characterization is inferred from the tag and PR:N, not from a formal weakness classification, so verify specifics against the Oracle advisory.

An attacker who can reach the Oracle EBS application tier over HTTP crafts requests against the CMRO Internal Operations component and, without authenticating, retrieves sensitive maintenance and operational records and makes limited unauthorized changes; the scope change means the exposed data may include information owned by other EBS modules. Because attack complexity is High, the attacker likely needs specific knowledge of the endpoint or environment conditions, and no public POC is known at time of analysis, so this would require original research or tooling.