Oracle Bills of Material CVE-2026-61283

Exploitation requires a valid low-privileged authenticated session within Oracle E-Business Suite (PR:L per CVSS vector) and network-level HTTP access to the Bills of Material Web Services component. No user interaction is required (UI:N). No special non-default configuration is indicated - the vulnerability exists in the Web Services component of Bills of Material as deployed in supported EBS versions. Exploitation is constrained by the authentication requirement: unauthenticated external attackers cannot exploit this without first obtaining credentials. Additionally, scope is unchanged (S:U), so exploitation cannot directly affect systems outside the Bills of Material module. Partial impacts only (C:L/I:L/A:L) - full data exfiltration or complete system takeover are not within scope of this vulnerability.

The CVSS 3.1 base score of 6.3 (Medium) is consistent with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, which accurately reflects a low-complexity, network-accessible attack limited to low-privileged authenticated users with partial impact across all three security properties. The scope is unchanged (S:U), meaning exploitation does not pivot to other system components. No EPSS score was provided in the intelligence data, so exploitation probability cannot be quantified. No KEV listing and no public POC exist as of this analysis, making active mass exploitation unlikely at this time. The primary limiting factor is the PR:L requirement - an attacker must already hold a valid low-privileged account within the EBS environment, materially reducing the external attack surface. Oracle EBS deployments are often internet-facing only via controlled proxies; however, insider threat and compromised low-privilege account scenarios remain realistic. Overall, this is a genuine but not critical priority: it should be patched in the next scheduled maintenance cycle rather than treated as an emergency.

An attacker with a valid low-privileged Oracle EBS account - such as a standard business user or a compromised service account - sends crafted HTTP requests to the Bills of Material Web Services endpoint. By manipulating the request parameters or payload, the attacker reads restricted manufacturing data, alters product structure records, or degrades Web Services availability for legitimate users. No public POC is known, but the low attack complexity (AC:L) suggests exploitation would not require specialized tooling once the vulnerable endpoint and request format are identified.