Oracle Sales Handhelds CVE-2026-61280

The attacker must possess a valid low-privileged authenticated account on the Oracle E-Business Suite instance (PR:L per CVSS vector) and have network-level HTTP access to the Oracle Sales for Handhelds application component. Exploitation further requires that the target EBS deployment runs a version between 12.2.3 and 12.2.15 and has the Sales for Handhelds module installed with the Outlook Sync Win 32 component accessible. No user interaction from any victim is required (UI:N). The scope is unchanged (S:U), confining impact to the Sales for Handhelds component itself. Limiting factors include: authentication is mandatory - unauthenticated external attackers cannot exploit this without first obtaining credentials; impact is partial across C/I/A, not full compromise; and the affected module is a niche EBS add-on not present in all EBS deployments.

The CVSS 3.1 base score of 6.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L positions this as easily exploitable by any authenticated low-privileged user with network HTTP access - no privilege escalation or preconditioned state is required. The low attack complexity is a meaningful risk amplifier: once credentials are obtained (via phishing, credential stuffing, or insider access), exploitation is straightforward. However, the scope-unchanged designation and partial (L) impacts across C/I/A cap the blast radius - an attacker gains limited data visibility, partial write capability, and the ability to cause a partial outage of the Sales for Handhelds component, not full system compromise. No EPSS data was provided in the intelligence, no public exploit code has been identified, and no CISA KEV listing exists, making this a medium-priority patch rather than an emergency response item. Real-world risk is most acute for organizations running Oracle EBS with the Sales for Handhelds module actively used and the Outlook Sync Win 32 endpoint exposed internally. CWE absence means the root cause cannot be independently cross-referenced against common exploitation patterns.

An authenticated low-privileged EBS user - or an attacker who has compromised such an account via phishing or credential stuffing - sends crafted HTTP requests to the Outlook Sync Win 32 endpoint within Oracle Sales for Handhelds. With low attack complexity and no user interaction needed, the attacker reads a subset of accessible sales data, inserts or modifies records, or degrades the availability of the Outlook Sync component. No public exploit code is known at time of analysis, but the ease of exploitation means this scenario requires minimal technical sophistication beyond valid credential possession.