Oracle Learning Management CVE-2026-61249

Exploitation requires a valid low-privilege user account within the Oracle E-Business Suite environment (PR:L per CVSS vector) with network access to the application over HTTP. No special configuration, non-default deployment mode, or specific platform variant is required beyond running an affected version (12.2.3-12.2.15) of Oracle Learning Management with the Import and Export component accessible. No user interaction by a victim is needed. Exploitation is limited by the requirement for at least one valid credential - fully unauthenticated exploitation is not indicated by the available data. The attack is further bounded by network reachability to the EBS HTTP endpoint; organizations that restrict EBS access to internal networks reduce exposure but do not eliminate risk from insider threats or compromised accounts.

The CVSS 3.1 base score of 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N reflects a realistic and accurately calibrated risk: the attack is network-reachable, requires no complex setup, demands only a low-privilege account (not anonymous access), and delivers high confidentiality impact with no integrity or availability consequences. The 'Authentication Bypass' tag creates a slight tension with PR:L - this is best interpreted as an authorization bypass (a lower-privileged user bypasses access control to read higher-privileged data) rather than a full unauthenticated bypass, which would typically warrant PR:N. No EPSS score was provided in the source data; without it, exploitation probability over 30 days cannot be quantified precisely, but the low attack complexity is a meaningful risk amplifier. There is no CISA KEV listing and no POC referenced, suggesting exploitation remains theoretical or opportunistic at time of publication. For organizations running Oracle EBS with LMS in internet-facing or shared-network environments, this should be treated as a priority patch given the data sensitivity of learning management systems (employee training records, compliance certifications).

An attacker with a valid low-privilege Oracle EBS user account - such as a regular employee account used for self-service training - sends crafted HTTP requests to the Import and Export endpoint of the Oracle Learning Management module. By exploiting the authorization bypass, the attacker retrieves data beyond their granted scope, including other users' training records, compliance certifications, or administrative LMS data, without triggering standard access denials. No public proof-of-concept exploit code has been identified, but the low complexity of the attack vector (no chaining or race conditions required) means exploitation is feasible by any attacker with network access and a valid low-privilege credential.