Oracle E-Business Suite CVE-2026-61322

Requires a valid low-privileged Oracle E-Business Suite account with network HTTP access to the TeleSales module's Internal Operations component (PR:L, so authentication is required but no admin rights). The affected deployment must run EBS 12.2.3-12.2.15 with the TeleSales web endpoints reachable by the attacker. Limiting factors: authentication is mandatory (unauthenticated internet exploitation is not indicated), and exploitation is confined to the TeleSales component (S:U, scope unchanged); no user interaction and no special non-default configuration are called out in the description, so any internet- or intranet-exposed EBS instance with TeleSales in use and a low-privilege credential is exposed.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8, High) indicates a network-reachable, low-complexity attack needing only low privileges and no user interaction, with full CIA impact confined to the vulnerable component (scope unchanged). This is a genuinely actionable priority for organizations running EBS 12.2.x: any authenticated low-privileged EBS user (a large population in typical deployments) can achieve module takeover. However, no EPSS score, no SSVC decision, no CWE, and no POC were provided in the input, and it is not in CISA KEV, so there is no evidence of active exploitation or automatable mass-exploitation at this time - the priority derives from the intrinsic severity and the broad EBS install base, not from confirmed exploitation. Note a mild signal conflict: the vendor tag says 'Information Disclosure' while the description and vector describe full takeover (C:H/I:H/A:H); treat the CVSS-described full-compromise impact as authoritative and the tag as an incomplete label.

An attacker who holds or phishes any low-privileged Oracle EBS account with access to TeleSales sends crafted HTTP requests to the Internal Operations endpoints and escalates the session into full control of the TeleSales module, reading and altering CRM/sales data and disrupting availability. No user interaction and no elevated privileges are required (AV:N/AC:L/PR:L/UI:N), making it straightforward for any insider or credential-compromising attacker. No public exploit code was identified at time of analysis.