Oracle Advanced Benefits CVE-2026-61141

Exploitation requires network access over HTTP to an Oracle E-Business Suite instance running Oracle Advanced Benefits (versions 12.2.7-12.2.15) with the Affordable Care Act component in use, and the attacker must hold valid low-privileged application credentials (PR:L - not anonymous/unauthenticated). Exploitation is further limited by high attack complexity (AC:H), meaning success depends on conditions the attacker does not directly control (e.g., specific application state, timing, or configuration), and by scope being unchanged (S:U), so impact is confined to the Advanced Benefits module itself. No user interaction is required (UI:N).

The signals are mixed and point to a genuine but not top-tier emergency priority. CVSS 3.1 is 7.5 (High) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H: network-reachable and needing only low privileges, but the AC:H (high attack complexity) materially lowers practical exploitability because success depends on conditions outside the attacker's control. There is no EPSS score, no POC, and no KEV entry in the provided data, so there is no evidence of active or imminent widespread exploitation. The vendor 'Information Disclosure' tag conflicts somewhat with the C:H/I:H/A:H 'takeover' language in the description - verify the true impact with Oracle, but the CVSS-declared full-impact triad should take precedence for prioritization. Net: a real, patch-now issue for EBS operators handling sensitive HR/benefits data, but the low-privilege requirement plus high complexity make mass opportunistic exploitation less likely than a targeted attack by an existing authenticated user.

A low-privileged but authenticated Oracle E-Business Suite user (for example, an HR self-service account) sends specially crafted HTTP requests to the Advanced Benefits ACA functionality, abusing a flaw to escalate their access and take over the module - reading sensitive benefits/healthcare data and altering or disrupting records. The high attack complexity means the attacker must satisfy specific application-state or configuration conditions for the attack to succeed. No public proof-of-concept is known at time of analysis.