Oracle Federal Financials CVE-2026-61319

Exploitation requires a valid low-privileged user account with network access to the Oracle EBS HTTP interface - specifically to the Internal Operations component of the U.S. Federal Financials module. The attacker must be able to authenticate to the EBS application at the PR:L level, meaning a basic application account (not necessarily an administrator or financial approver) is sufficient. No elevated Oracle database credentials, OS access, or special configuration is needed beyond the baseline EBS login. Exploitation is limited to organizations running Oracle E-Business Suite with the U.S. Federal Financials module installed and activated on versions 12.2.3 through 12.2.15; organizations not licensed for or not running this specific module are not affected. The unchanged scope (S:U) means the attacker cannot automatically pivot to the underlying operating system or database host through this vector alone.

The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) signals high real-world risk for any organization running the affected versions. The combination of network accessibility, low attack complexity, and only low-privilege requirements means any authenticated EBS user - including lower-trust contractor or read-only accounts - could potentially trigger full system takeover. No EPSS score was supplied, preventing probabilistic exploitation forecasting. No CISA KEV listing exists at time of analysis, suggesting exploitation has not yet been publicly confirmed in the wild, though absence from KEV does not guarantee safety. No POC code was identified. Despite the high CVSS, prevalence is inherently limited to U.S. federal government and government-adjacent entities running Oracle EBS with this module enabled, which meaningfully constrains the exposed attack surface globally. For affected federal deployments, however, risk is unambiguously critical given the sensitivity of federal financial data and the low barrier to exploitation once any valid credential is obtained.

An attacker who has obtained any low-privileged Oracle EBS account - through phishing, credential stuffing, or insider access - sends a crafted HTTP request to the Internal Operations component of the Federal Financials module over the standard EBS HTTP port. With no further authentication escalation or user interaction required, the vulnerability allows the attacker to achieve full takeover of the Oracle U.S. Federal Financials application, potentially exfiltrating sensitive federal financial records, manipulating financial transactions, or disrupting system availability. No public POC exists at time of analysis, but the low attack complexity (AC:L) suggests exploitation would be straightforward once the vulnerability mechanism is identified.