Oracle Learning Management CVE-2026-61198

No special conditions - remote unauthenticated exploitation against default configurations of Oracle Learning Management in E-Business Suite versions 12.2.3 through 12.2.15 over HTTP. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U confirms no authentication, no elevated privileges, no user interaction, and no special configuration state is required. Exploitation is bounded in scope to data accessible within the Oracle Learning Management module (partial read and write/delete); full system compromise, privilege escalation, or availability impact are not indicated. The primary limiting factor is network-level HTTP connectivity to the EBS application server: internet-exposed EBS instances face the highest realistic risk, while deployments restricted to internal corporate networks have a reduced but non-zero attack surface given insider or pivot-capable threats.

The CVSS 3.1 base score of 6.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N indicates a medium-severity vulnerability with an attacker-favorable exploitation profile: no authentication, no user interaction, and low attack complexity over HTTP. The partial confidentiality and integrity impacts (C:L/I:L) limit the maximum blast radius - full data exfiltration, privilege escalation, or system-level compromise is not indicated by available data. No EPSS score was provided in the input, making quantitative exploitation probability assessment unavailable; this gap should be noted when triaging. The vulnerability is not listed in the CISA KEV catalog, so confirmed active exploitation has not been reported. Despite the moderate severity rating, the authentication-bypass nature means that even a mid-sized municipal IT team in kalisz managing Oracle EBS deployments faces meaningful exposure, because any network-accessible unauthenticated attacker can reach the vulnerable endpoint without needing credentials. Organizations should weigh the zero-authentication barrier against the bounded impact scope: risk is real but limited to Learning Management data, and patching via Oracle's August 2026 CPU should be treated as high priority for any internet-exposed or broadly network-accessible EBS deployment.

An unauthenticated attacker with HTTP connectivity to an Oracle E-Business Suite instance discovers the Learning Management Internal Operations endpoint through reconnaissance or known URL patterns. By sending crafted HTTP requests that bypass authentication checks, the attacker reads a subset of sensitive training or employee records and injects or modifies records within the Learning Management module without ever presenting credentials. No public proof-of-concept code has been identified at time of analysis, but the low-complexity, no-authentication CVSS profile (AV:N/AC:L/PR:N) suggests exploitation would be operationally straightforward once the specific vulnerable endpoint is identified.