Oracle Learning Management CVE-2026-62527

Exploitation requires a valid low-privileged account in Oracle E-Business Suite with access to the Oracle Learning Management module (PR:L per CVSS vector). Network access via HTTP to the EBS application tier is required (AV:N). The vulnerability affects the Import and Export component specifically - access to this component within the attacker's EBS responsibility or role is a prerequisite. Exploitation does not require administrator or DBA-level credentials and does not require any victim user interaction (UI:N). Limiting factors: the attacker must possess valid EBS credentials; Oracle EBS is typically not internet-exposed, restricting the attack to authenticated insiders, VPN users, or attackers who have previously compromised credentials. Non-default deployment of EBS outside a protected network perimeter would materially increase risk. The partial DOS impact (A:L) is bounded to the LMS component, not the broader EBS platform.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, score 6.3) indicates a network-reachable flaw with low complexity that nonetheless mandates a valid low-privileged account (PR:L), which is the primary real-world risk limiter. Oracle EBS is typically deployed within enterprise intranets behind VPN or perimeter controls, further narrowing the attack surface to authenticated insiders or attackers who have already obtained credentials. No EPSS score is available from the provided data. No public exploit has been identified and the vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation at time of analysis. The partial impact across confidentiality, integrity, and availability (all Low) indicates nuisance-tier data exposure and manipulation rather than full system compromise. Overall real-world priority is moderate for organizations running EBS in environments where low-privileged internal or contractor accounts exist, and lower where strict network segmentation and role-based access controls are enforced. The missing CWE is a gap - without knowing the root cause class, the completeness of any workaround cannot be fully assessed.

An attacker holding a low-privileged Oracle EBS account - such as a learner or contractor with access to the Oracle Learning Management module - sends crafted HTTP requests to the Import and Export component. By manipulating the request parameters or payload, the attacker reads learner records or course data outside their permitted scope, inserts or modifies training completion records, or triggers repeated operations that partially degrade LMS availability. No public exploit code has been identified, meaning this scenario currently requires attacker familiarity with the EBS HTTP interface rather than off-the-shelf tooling.