Oracle Sales CVE-2026-62601

Exploitation requires a valid Oracle E-Business Suite account with at minimum low-privilege access - fully unauthenticated exploitation is not supported by the CVSS PR:L vector. The attacker must have network access to the Oracle EBS application server via HTTP. No special non-default configuration is required; any EBS deployment in the 12.2.3-12.2.15 range with Oracle Sales enabled is potentially affected. The limiting factors are: (1) a valid EBS user credential must be obtained or already possessed; (2) the Oracle Sales module must be licensed and deployed on the EBS instance; (3) network access to the EBS HTTP endpoint must be reachable from the attacker's position. Exploitation does not require administrative privileges, elevated roles, or specific Sales configuration beyond the module being present.

The CVSS 3.1 base score of 7.1 is driven by AV:N (network-accessible via HTTP), AC:L (no special conditions or race conditions required), PR:L (low-privileged account required), UI:N (no victim interaction needed), with high confidentiality and low integrity impact and no availability impact. The 'Authentication Bypass' tag creates a slight tension with PR:L - this is best interpreted as a post-authentication authorization bypass rather than a pre-authentication attack, meaning an attacker needs a valid (even minimal) EBS account. This is a meaningful but non-trivial prerequisite in enterprise environments. EPSS data is not available in the provided intelligence, and no KEV listing or publicly available exploit code has been identified. No POC status is reported. The real-world risk is elevated for organizations where Oracle Sales data is sensitive (customer pipelines, deal financials, strategic accounts) and where insider threat or compromised low-privilege credentials are realistic scenarios. The absence of availability impact and the scope being unchanged (S:U) limit blast radius to data exposure within Oracle Sales. This is a genuine remediation priority for EBS deployments, not merely a high-CVSS low-real-risk issue, given how easily exploitable the vector is once an account is obtained.

An attacker who obtains a low-privileged Oracle E-Business Suite account - through credential stuffing, phishing, or insider access - sends crafted HTTP requests to the Oracle Sales Internal Operations component, bypassing authorization checks to enumerate and extract sensitive sales records, customer data, pipeline information, and deal financials beyond their assigned role. The low attack complexity means no special tooling or timing is required; standard HTTP interaction with the EBS application layer is sufficient to trigger the bypass.