Oracle Product Workbench CVE-2026-61269

Exploitation requires a valid low-privileged authenticated account within the Oracle E-Business Suite environment - unauthenticated external attackers cannot exploit this vulnerability without first obtaining credentials (PR:L). The attacker must have HTTP network access to the Product Workbench WebUI component, which means the module must be deployed and reachable. No user interaction beyond the attacker's own requests is required (UI:N), and no elevated complexity or preconditions are needed beyond the authenticated session (AC:L). Scope is contained to the vulnerable system (S:U). What limits exploitation: the requirement for at least low-level EBS authentication prevents purely external unauthenticated exploitation; organizations that have not deployed or licensed the Product Workbench module are not affected; and environments that restrict WebUI access to specific trusted IP ranges reduce the reachable attacker population significantly.

The vendor-assigned CVSS 3.1 score of 6.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L reflects a genuine but bounded risk: network-reachable, no complexity, no user interaction required - but scoped to the vulnerable system and with only partial (Low) impact across confidentiality, integrity, and availability. Oracle explicitly labels this 'easily exploitable,' which in CPU advisory language means the attack is straightforward given the prerequisite of a low-privileged account. EPSS data is absent from available intelligence and cannot be assessed. The vulnerability is not listed in CISA KEV, and no public exploit code has been reported. The practical threat is highest in organizations where EBS Product Workbench is internet-facing or accessible to a broad internal user population with low-trust accounts. For organizations with strict internal network segmentation and tight EBS user management, real-world risk is moderate rather than urgent. No conflicting signals between CVSS and the description are apparent - PR:L is consistent with the authenticated attacker requirement stated in the advisory.

An attacker holding a low-privileged Oracle E-Business Suite user account - whether a malicious insider, a compromised credential, or an account provisioned with minimal permissions - sends crafted HTTP requests directly to the Product Workbench WebUI endpoint. By exploiting weak or missing authorization enforcement in the WebUI layer, the attacker reads product records they should not have access to, modifies or deletes product data within scope, and intermittently disrupts service availability for other users of the module. No public exploit code has been identified, but Oracle's 'easily exploitable' characterization suggests the technique is unlikely to require advanced tooling.