Oracle Customers Online CVE-2026-61297

Exploitation requires network reachability to the Oracle E-Business Suite web tier over HTTP and a valid low-privilege application account on Oracle Customers Online (CVSS PR:L confirms authentication is needed - this is not an unauthenticated flaw despite the 'Authentication Bypass' tag, which refers to bypassing authorization boundaries once logged in). No user interaction is required (UI:N) and attack complexity is low (AC:L), so any authenticated low-privilege user can trigger it against affected versions 12.2.3-12.2.15. Limiting factors: the attacker must first obtain credentials, and only these specific EBS 12.2 releases running the Customers Online / Internal Operations component are affected; environments that restrict the EBS web tier to trusted networks and tightly control low-privilege accounts materially reduce realistic exposure.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N describes a network-reachable, low-complexity, low-privilege attack requiring no user interaction, yielding high confidentiality and integrity impact - a realistic and attractive target profile because it only needs any valid low-privilege EBS account. No EPSS score, SSVC decision, or KEV entry was provided in the input, and no proof-of-concept is referenced, so real-world exploitation signals are currently absent and cannot be asserted. The main mitigating factor is PR:L: exploitation presumes the attacker already holds valid application credentials (or can obtain them), which limits fully anonymous internet-wide attacks but is a low bar for insiders, compromised accounts, or environments with broad self-registration. Net assessment: a genuine high-priority patch given the broad data impact and easy exploitability, tempered only by the authentication prerequisite and the lack of any confirmed active exploitation in the supplied data.

An attacker who holds (or phishes/compromises) any low-privilege Oracle Customers Online account authenticates to the EBS web tier and sends crafted HTTP requests to the Internal Operations component, bypassing intended authorization to read and alter customer master data. With no user interaction and low attack complexity, the attacker can exfiltrate all accessible customer records and create, modify, or delete critical data. No public proof-of-concept is identified at time of analysis, so this scenario is derived from the CVSS vector rather than a demonstrated exploit.