Oracle Advanced Benefits CVE-2026-61282

Exploitation requires a valid low-privileged account in Oracle E-Business Suite with HTTP network access to the Self Service Benefits component (versions 12.2.4 through 12.2.15). No elevated privileges, administrative rights, or special role assignments are confirmed as necessary beyond basic EBS authentication. No user interaction from a victim is required. Exploitation is limited by: the requirement for at least one valid EBS credential (PR:L per CVSS); network reachability to the EBS application tier via HTTP; and the scope constraint (S:U), meaning the attack is bounded to the Advanced Benefits module and does not provide lateral movement to the broader EBS instance or underlying OS. No non-default configuration or specific feature toggle has been identified as a prerequisite - any deployment of the affected versions with Self Service Benefits accessible is potentially exposed.

The CVSS 3.1 base score of 6.3 (Medium) reflects a balanced triple-impact profile - Confidentiality, Integrity, and Availability each rated Low - with no scope change and low attack complexity. The PR:L requirement is the primary limiting factor: exploitation requires a valid, low-privileged EBS account, ruling out fully unauthenticated internet-facing attacks. However, in most EBS deployments, low-privileged accounts are widespread (employees, contractors, HR portal users), making the effective attacker pool large within any organization. No EPSS score was provided in the intelligence data. There is no CISA KEV listing and no known public proof-of-concept, indicating no confirmed active exploitation at time of analysis. SSVC signals: exploitation status is 'none'; automatable is 'yes' given AC:L/PR:L/UI:N once credentials are obtained; technical impact is 'partial'. Real-world prioritization should be moderate - the attack is straightforward once credentials exist, but the impact ceiling is low (no full system takeover, no scope change). Organizations with strict separation between EBS users and sensitive benefits data face lower residual risk; those where all employees have EBS portal access face the highest.

An employee or contractor with a standard Oracle E-Business Suite portal account sends a crafted HTTP request to the Self Service Benefits endpoint - exploiting the authorization flaw - to read another employee's benefit enrollment records, alter benefit election data, or trigger errors that partially degrade the component's availability. Because attack complexity is low and no user interaction is required, this could be scripted and repeated across multiple target records once an attacker understands the flaw pattern.