Oracle E-Business Suite CVE-2026-61309

The affected component - Oracle In-Memory Cost Management for Discrete Industries (Internal Operations) - must be present and its HTTP endpoint reachable by the attacker on an EBS 12.2.3-12.2.15 deployment. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special privileges are required, so no special conditions beyond network reachability apply against affected default configurations. The primary limiting factors are therefore network exposure (instances isolated behind VPN/URL-firewall or not internet-facing are not remotely reachable) and version applicability (only 12.2.3 through 12.2.15 are listed as affected); impact is limited to data confidentiality, with no integrity or availability effect.

The CVSS vector AV:N/AC:L/PR:N/UI:N indicates remote, low-complexity, unauthenticated exploitation with no user interaction - the highest-exposure profile for the access dimensions - while the impact is confined to confidentiality (C:H, I:N, A:N), which is why the score caps at 7.5 rather than higher. Oracle's 'Easily exploitable' language reinforces the low-complexity rating. Countervailing signals lower urgency: no EPSS score was provided, the CVE is not listed in CISA KEV, and no public POC was identified, so there is no evidence of active or imminent mass exploitation at this time. Oracle EBS is historically a high-value target and prior EBS auth-bypass/data-disclosure bugs have drawn exploitation, so internet-facing instances should treat this as a real priority despite the absence of an exploitability probability. Note the tag claims 'Authentication Bypass' but the CVE text describes unauthorized data access; verify the precise nature with Oracle's advisory as this affects whether write/lateral impact is possible (Oracle scored I:N/A:N, so read-only disclosure is the confirmed impact).

An attacker who can reach the EBS web tier over HTTP sends a crafted request to the In-Memory Cost Management for Discrete Industries endpoint and, without supplying valid credentials, retrieves sensitive cost-management and related business data. Because the attack requires no authentication, no user interaction, and low complexity, it can be scripted and run against any internet-exposed EBS 12.2.x instance; no public POC has been identified at time of analysis.