Oracle Advanced Benefits CVE-2026-61325

Exploitation requires the attacker to already possess a HIGH-privilege authenticated account within Oracle Advanced Benefits / E-Business Suite (CVSS PR:H) and network HTTP access to the EBS web tier reaching the 'Internal Operations' component of Advanced Benefits 12.2.15. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the high-privilege prerequisite is the primary limiting factor - this is not anonymously exploitable, and only version 12.2.15 is named as affected. The scope-change (S:C) condition means a successful attack can affect resources beyond the Advanced Benefits security authority. Note the tension between the 'Authentication Bypass' tag and the PR:H vector; PR:H is the metric of record and should govern defensive assessment unless Oracle's advisory states otherwise.

The CVSS 3.1 base score is 7.6 (High) with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N - network-reachable, low complexity, no user interaction, but requiring HIGH privileges (PR:H). The score is driven up largely by the scope change and High confidentiality impact rather than by ease of access: an attacker must already hold a high-privilege EBS account, which limits the realistic attacker population to insiders or those who have already compromised a privileged account. No EPSS score was supplied, so exploitation probability cannot be quantified. The issue is NOT in CISA KEV and no POC was reported, so there is no evidence of active exploitation or public weaponization. A conflicting signal worth verifying: the vendor tag says 'Authentication Bypass,' yet the CVSS vector requires PR:H - these are in tension. A true pre-authentication bypass would carry PR:N, not PR:H; treat the 'Authentication Bypass' tag as an unverified label and rely on the PR:H vector, meaning realistic risk is elevated-insider/post-compromise rather than anonymous internet exploitation. Priority: patch on the normal Oracle CPU cadence - not a drop-everything emergency given PR:H and no exploitation evidence, but the scope change and High confidentiality impact make it more than theoretical in large EBS estates.

An attacker who already holds a high-privilege Oracle Advanced Benefits account (a malicious insider, or an outsider who has phished/compromised such an account) sends crafted authenticated HTTP requests to the Internal Operations component. Leveraging the scope-change weakness, they read confidential data across the application and perform limited unauthorized inserts/updates/deletes, with impact potentially spilling into adjacent Oracle EBS products. No public exploit code is known at time of analysis, so this would currently require the attacker to develop their own technique.