Oracle E-Business Suite CVE-2026-61218

Exploitation requires network access to the Oracle E-Business Suite Secure Enterprise Search HTTP interface and a valid low-privilege EBS user account (CVSS PR:L) - it is NOT unauthenticated. The specific target is the Search Integration Engine component of Secure Enterprise Search on EBS 12.2.3-12.2.15. No user interaction and no elevated privileges are needed (UI:N, AC:L), so any authenticated low-privilege user who can reach the SES endpoint over HTTP can attempt it. Limiting factors: the attacker must first possess valid credentials, the affected component must be deployed and network-reachable, and the target must be within the 12.2.3-12.2.15 version range; the vendor 'Authentication Bypass' tag should be confirmed with Oracle as it may indicate the credential barrier is weaker than PR:L implies.

This is a genuine priority rather than an inflated high score. The CVSS vector is internally consistent with the description: AV:N and AC:L confirm easy remote exploitation over HTTP, PR:L confirms a low-privileged (but authenticated) attacker, UI:N means no victim interaction, and C:H/I:H/A:N match the stated read/write-but-not-destroy-availability impact. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so probabilistic and exploitation-status signals are absent - the assessment rests on the CVSS vector and Oracle's description alone. The requirement for valid low-privilege credentials (PR:L) is the main limiting factor and lowers real-world risk relative to a fully unauthenticated flaw; however, EBS deployments often have many low-privilege accounts, so the barrier is modest. The 'Authentication Bypass' tag is worth verifying with Oracle, as it could imply the privilege barrier is weaker in practice than PR:L suggests.

An attacker who holds or obtains any low-privilege EBS account authenticates and sends crafted HTTP requests to the Secure Enterprise Search Integration Engine, abusing the weak authorization check to query and alter records beyond their intended scope. Because attack complexity is low and no user interaction is needed, the attacker can then read sensitive business data and create, modify, or delete records accessible to SES. No public exploit code has been identified at time of analysis.