Oracle Sales CVE-2026-62600

Exploitation requires a valid low-privilege account within Oracle Sales (PR:L per CVSS vector) and network access to the Oracle E-Business Suite instance over HTTP. The CVSS vector (AC:L) confirms no special configuration or race condition is needed beyond these prerequisites. Limiting factors: an unauthenticated external attacker cannot exploit this directly - at minimum, credential acquisition or insider access is required. No special configuration flag or non-default feature enablement is described as a prerequisite. The scope is unchanged (S:U), so exploitation is contained to Oracle Sales data accessible within the compromised session. Exploitation is not constrained to a specific platform or OS, as Oracle EBS runs on a standardized stack.

The CVSS 3.1 score of 8.1 is well-supported by the vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N): a low-privileged authenticated user can exploit this remotely over HTTP with no additional complexity or user interaction required, which is a common and realistic attacker profile in enterprise Oracle EBS environments. The dual C:H/I:H impact - full data read and write - is particularly severe for a CRM system holding sensitive customer, sales pipeline, and contract data. No EPSS score was provided in the source data, limiting probabilistic exploitation risk assessment. The CVE is not currently in the CISA KEV catalog, and no POC has been identified, suggesting exploitation is not yet widespread or automated. Despite the absence of KEV status, the low barrier to exploitation (only a valid low-privilege account needed) means any organization running Oracle EBS in internet-facing or shared-network configurations should treat remediation as urgent - the gap between KEV listing and active exploitation can be short for high-profile enterprise platforms. Availability impact is explicitly absent (A:N), so business continuity is not the primary concern here; data exfiltration and manipulation are.

An attacker with a valid low-privilege Oracle Sales account - such as a read-only sales representative or a compromised service account - sends crafted HTTP requests to the Internal Operations component of Oracle E-Business Suite. Due to improper authorization enforcement, the attacker can read all Oracle Sales data (including customer records, contracts, and pipeline data) and create, modify, or delete critical records. No public POC has been identified, but the low complexity means a motivated attacker with EBS knowledge could develop an exploit independently.