Oracle E-Business Suite CVE-2026-61289

Exploitation requires network access to the Oracle E-Business Suite application tier over HTTP and a valid low-privileged EBS application account (CVSS PR:L) - it is not unauthenticated. The vulnerable surface is the OPM Product Development product's Quality Management Specs component in EBS 12.2.15; environments not running this OPM module, or not on 12.2.15, are outside the stated affected scope. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once an attacker has any qualifying low-privilege login and network reachability to the EBS web tier, there are no further special configuration prerequisites named by Oracle. The primary limiting factors are the authentication requirement and network reachability to the EBS instance, meaning internet-exposed EBS deployments with broad user bases are at materially higher realistic risk than tightly segmented internal-only installations.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) presents a genuinely serious profile: network-reachable over HTTP, low attack complexity, no user interaction, and full triple impact, gated only by low-privilege authentication (PR:L). Oracle explicitly labels it 'easily exploitable,' which strengthens the case that the PR:L barrier is modest in practice - many EBS deployments have numerous internal users holding at least low-privilege application accounts. However, several key signals are missing: no EPSS score, no SSVC decision data, and no CWE were provided, so automatability and exploitation-probability cannot be independently weighed. It is NOT in CISA KEV and no POC is known, so there is no evidence of active or imminent exploitation despite the high CVSS. Net: treat as a high-priority patch for internet-exposed or large-user-base EBS environments, but the absence of KEV/POC/EPSS data means the current real-world exploitation likelihood is unconfirmed rather than proven.

An attacker who holds any low-privileged Oracle E-Business Suite account (for example, a routine internal user, contractor, or a compromised employee login) sends crafted HTTP requests to the OPM Product Development Quality Management Specs component over the network. Because attack complexity is low and no user interaction is needed, the attacker leverages the flaw to escalate into full compromise of the OPM Product Development module, gaining the ability to read, alter, and disrupt manufacturing specification data. No public POC is known at time of analysis, so exploitation would currently require independent vulnerability research.