Oracle Lease and Finance Management CVE-2026-61337

Exploitation requires an authenticated low-privilege account on the target Oracle EBS instance (PR:L) with HTTP network access to the Lease and Finance Management Internal Operations component, and requires no user interaction (UI:N). Limiting factors: the CVSS AC:H rating means the attacker must meet specific conditions outside their control - such as winning a race, meeting particular data or state prerequisites, or defeating a mitigation - which makes reliable exploitation difficult; exposure is further bounded to affected versions 12.2.11 through 12.2.15 and to environments where a low-privileged attacker can actually reach the EBS web tier. The exact triggering feature or configuration is not detailed in Oracle's summary-style advisory.

The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.5) describes a network-reachable but hard-to-exploit flaw that requires an existing low-privilege authenticated session and yields total compromise of the product on success. The high attack complexity (AC:H) and required privileges (PR:L) meaningfully reduce real-world exploitability relative to an unauthenticated network flaw, which is why the score lands at 7.5 despite triple-high impact. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so probabilistic and in-the-wild signals are absent; note the conflict between the vendor's 'Information Disclosure' tag and the description's 'takeover' plus the full-impact vector - treat the CVSS vector and description as authoritative over the tag. Net priority: a genuine high-severity issue for organizations running EBS 12.2 Lease and Finance Management, but the authentication and complexity barriers make it a scheduled-CPU-cycle fix rather than an emergency, absent evidence of active exploitation.

An attacker who already holds a low-privilege Oracle EBS account - an internal user, contractor, or someone using credentials obtained via phishing - sends specially crafted HTTP requests to the Lease and Finance Management Internal Operations endpoints. By satisfying the specific conditions that make the flaw exploitable, they escalate from limited access to full compromise of the module, reading and altering leasing and finance data and disrupting the service. Exploitation is non-trivial (AC:H) and no public POC is identified at time of analysis.