Oracle EAM CVE-2026-61296

Exploitation requires the attacker to hold at minimum a low-privileged authenticated account within Oracle Enterprise Asset Management (PR:L per Oracle-supplied CVSS vector). A human victim other than the attacker must actively interact with attacker-influenced content - such as clicking a crafted URL or loading a page containing injected material - as reflected by UI:R. The vulnerability is specific to the Linear Asset Management subcomponent running on Oracle EBS versions 12.2.3 through 12.2.15; instances outside this version range are not confirmed affected. The scope change (S:C) implies that while the exploit entry point is within EAM, impact can extend to other EBS modules accessible within the victim's session. The Authentication Bypass tag reported alongside this CVE is a potential conflict with the PR:L vector assignment - if the tag is accurate, exploitation may require fewer privileges than the CVSS vector indicates; this should be verified against the Oracle CPU advisory and My Oracle Support documentation. No special non-default configuration is stated as required beyond running an affected version of the product with the Linear Asset Management component active.

The CVSS 3.1 base score of 7.6 (High) is driven primarily by the scope change, high confidentiality impact, and network accessibility at low complexity, partially offset by the low privilege requirement (PR:L) and mandatory human interaction (UI:R). No EPSS score is available in the provided data, and the CVE does not appear in the CISA Known Exploited Vulnerabilities catalog, indicating no confirmed active exploitation at time of analysis. The Authentication Bypass tag reported alongside this CVE introduces a notable discrepancy - if this represents a true pre-authentication bypass rather than a post-authentication flaw, the effective privilege requirement could be lower than PR:L suggests; however, the Oracle-supplied CVSS vector (PR:L) should be treated as authoritative absent explicit vendor clarification. The scope change (S:C) elevates practical risk in environments where EAM is tightly integrated with other E-Business Suite modules, as lateral impact to adjacent systems within the same session is plausible. The UI:R requirement limits fully automated, mass exploitation - reducing opportunistic attack risk - but social engineering or stored-payload scenarios remain viable; even a mid-sized enterprise IT team in boleslawiec should treat this as urgent given the high confidentiality exposure and Oracle's quarterly CPU cadence, which leaves organizations exposed for up to 90 days between patch releases. No POC exploit code has been publicly identified, which reduces near-term exploitation likelihood but does not eliminate risk given the availability of the vendor advisory as a roadmap for reverse engineering.

A low-privileged EAM account holder crafts a malicious HTTP link or injects a payload into a Linear Asset Management form field, then socially engineers a higher-privileged user into interacting with it - such as opening a shared asset report or clicking a crafted URL. Upon interaction, the attacker's payload executes in the victim's authenticated browser session, exfiltrating sensitive EAM records and potentially accessing other E-Business Suite modules accessible to the victim's session due to the scope change. No public proof-of-concept code has been identified at time of analysis.