Oracle E-Business Suite CVE-2026-61329

Exploitation requires an authenticated low-privileged Oracle E-Business Suite account (CVSS PR:L) with network HTTP access to the EBS web tier hosting the Price Protection Internal Operations component; it does not require user interaction or elevated privileges. What limits it: the attacker must already possess valid low-privileged credentials and be able to reach the EBS HTTP interface, so environments that expose the EBS web tier only to trusted internal networks and tightly scope user responsibilities meaningfully reduce exposure. The affected deployment must be Oracle Price Protection running on EBS 12.2.3 through 12.2.15; releases outside this range and non-Price-Protection EBS modules are not in scope per the advisory.

The signals are mostly aligned toward genuine priority: CVSS vector AV:N/AC:L/PR:L/UI:N gives network reachability, low attack complexity, no user interaction, and only a low-privileged account as a barrier, with High confidentiality and integrity impact (C:H/I:H, A:N). SSVC-style reading: exploitation is not confirmed in the wild, the flaw is likely automatable given AC:L/UI:N, and technical impact on the module's data is total. However, key corroborating signals are missing or unfavorable to over-prioritization: no EPSS score, no CISA KEV listing, and no POC were provided, so there is no evidence of active or widespread exploitation yet - this is a freshly disclosed CPU item, not a known-exploited bug. The one tension to verify is the 'Authentication Bypass' tag versus the PR:L vector: the CVSS explicitly requires an existing low-privileged account (PR:L), so this is privilege escalation / horizontal access abuse by an authenticated user rather than a true pre-auth bypass - treat the 'Authentication Bypass' tag with caution and confirm with the Oracle advisory. Net: a real high-priority patch for EBS operators exposing the web tier, but not an emergency zero-day.

An attacker who holds or phishes any low-privileged Oracle EBS application account with network access to the web tier sends crafted HTTP requests to the Price Protection Internal Operations functionality, bypassing the intended authorization checks to read and alter pricing data across the module. Because no user interaction and only low complexity are required, the attacker can then exfiltrate or tamper with all Price Protection-accessible data, corrupting pricing or claims records. No public POC was identified in the provided data.