Oracle E-Business Suite CVE-2026-61301

Exploitation requires network HTTP access to the Oracle E-Business Suite application tier and a low-privileged authenticated EBS account (CVSS PR:L), targeting the Process Manufacturing Financials component of a deployment running affected versions 12.2.3-12.2.15. What limits exploitation: the attacker must already possess valid (even minimal) EBS credentials - it is not remote-unauthenticated per the CVSS vector - and the OPM Financials module must be deployed and reachable. A limiting caveat is that the 'Authentication Bypass' tag conflicts with PR:L; if Oracle confirms an actual auth-bypass path, the credential prerequisite may not hold, so verify with the vendor advisory.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N yields 8.1 (High): remotely reachable over HTTP, low attack complexity, no user interaction, but requiring low-level privileges (an existing EBS account). No EPSS score, KEV entry, or POC was provided, so real-world exploitation probability cannot be quantified from the input and there is no public exploit identified at time of analysis. The practical risk hinges on the PR:L requirement - because a valid low-privilege EBS login is needed, the realistic threat model is a malicious or compromised internal/partner account rather than mass unauthenticated internet scanning. Note the conflict between the 'Authentication Bypass' tag (implying no auth) and CVSS PR:L (implying auth required); this should be resolved with Oracle before downgrading or upgrading urgency. Given EBS's role as a system of record for financial data, the C:H/I:H impact makes this a meaningful priority for organizations running affected 12.2.x versions despite the absence of active-exploitation signals.

An attacker who holds or has phished a low-privilege Oracle EBS user account sends crafted HTTP requests to the Process Manufacturing Financials module and, exploiting the authorization weakness, reads and alters financial records they should not be able to reach. No user interaction and low complexity are required, so a single valid account is enough; no public POC has been identified at time of analysis.