Oracle Contracts Integration CVE-2026-61338

Requires a valid low-privilege authenticated session on the Oracle E-Business Suite web tier (PR:L) with network/HTTP reachability to the Contracts Integration Internal Operations component; no user interaction and no elevated privileges are needed. Exploitation is limited to EBS deployments running the affected 12.2.3-12.2.15 releases where the Contracts Integration module is provisioned and where the attacker can authenticate - organizations that keep EBS off the public internet or tightly restrict low-privilege account provisioning materially shrink the attackable population. The 'Authentication Bypass' tag suggests the flaw may let an authenticated user cross authorization boundaries rather than defeat login entirely; confirm the exact precondition against the Oracle CPU July 2026 advisory.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N yields 8.1 (High): network reachable, low complexity, only low privileges, no user interaction, unchanged scope, high confidentiality and integrity impact, no availability impact. Oracle's 'easily exploitable' language reinforces AC:L/PR:L - the main gate is holding any valid low-privilege EBS account. Countervailing signals: no EPSS probability was provided, the CVE is not in CISA KEV, and no POC is referenced, so it is not confirmed as actively exploited. The 'Authentication Bypass' tag is in mild tension with PR:L (which implies the attacker is already authenticated), suggesting an authorization bypass by an authenticated user rather than a fully unauthenticated bypass - verify against the Oracle advisory. Net: a genuine high priority for organizations running EBS 12.2 with many internal users, but current evidence indicates insider/opportunistic risk rather than mass exploitation.

An attacker who holds or phishes any low-privilege Oracle EBS account logs into the web tier and sends crafted HTTP requests to the Contracts Integration / Internal Operations functions, bypassing the module's authorization checks to read and alter contract data outside their assigned scope. No user interaction or elevated privileges are needed and complexity is low, so a single valid internal credential suffices. No public POC is referenced, so an attacker would develop the request sequence from the advisory or their own testing.