Oracle EBS CVE-2026-61139

A valid low-privileged Oracle E-Business Suite application account is required - unauthenticated exploitation is not possible per the CVSS PR:L metric. The attacker must have network access to the Oracle EBS HTTP interface (standard port 80/443). No non-default configuration or special feature enablement is described as a prerequisite; any standard deployment of Oracle Public Sector Financials (International) versions 12.2.3-12.2.15 that is network-accessible and has the Authorization component active appears susceptible. Key limiting factors: (1) requires a valid low-privileged application account - organizations with strict account provisioning and no shared or stale accounts reduce exposure significantly; (2) network accessibility - deployments restricted to internal networks or VPN-only access reduce attack surface; (3) the module is public-sector-specific, narrowing the applicable deployment footprint.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) places this at 6.3 - Medium. Key signals: network-accessible (AV:N), low complexity (AC:L), but requires a low-privileged account (PR:L), which is a meaningful brake on mass exploitation. Impacts are partial across all three CIA pillars, with no scope change (S:U). No EPSS data was provided in the intelligence package; without it, exploitation probability cannot be quantified. The vulnerability is absent from CISA KEV, and no publicly available POC code was identified, making opportunistic mass exploitation unlikely in the near term. For public sector organizations - the primary deployment base - partial data integrity and confidentiality loss in a financial system carries regulatory and audit risk disproportionate to the raw CVSS score, elevating operational priority. SSVC inference: exploitation status is 'none publicly known'; automatable is plausible (low complexity) but constrained by PR:L; technical impact is partial. Overall: a genuine but not critical patch-cycle priority, elevated for government financial environments.

An attacker with a valid low-privileged Oracle EBS account - obtained via phishing, credential stuffing, or insider access - sends crafted HTTP requests to the Public Sector Financials (International) Authorization component, bypassing permission checks that should restrict their access. The attacker can then read financial records outside their authorized scope, manipulate transactions, or trigger conditions that degrade service availability for legitimate users. No public POC code has been identified, meaning this scenario currently requires attacker knowledge of the specific authorization flaw, limiting the realistic threat pool.