Oracle Partner Management CVE-2026-62605

Exploitation requires Oracle Partner Management version 12.2.3 through 12.2.15 to be accessible over HTTP from the attacker's network position. The critical limiting condition is that an authenticated Oracle EBS user (other than the attacker) must actively interact with attacker-controlled content - for example, by clicking a crafted HTTP link (UI:R). This interaction requirement prevents fully automated, scanner-driven exploitation. No special non-default configuration is documented as required; the vulnerability appears to affect default deployments of the affected versions. The scope change to additional products is conditioned on the interconnected nature of Oracle EBS's application suite being present. What limits exploitation in practice: the human interaction dependency raises the bar above mass exploitation; internal-only network deployments further constrain attacker reach to those with internal access or social engineering capability.

The CVSS 3.1 score of 8.2 (High) is driven primarily by network accessibility, zero authentication requirement, low attack complexity, and a scope change with high confidentiality impact. The UI:R requirement is the single friction point that prevents fully automated mass exploitation - an attacker must social-engineer a victim into interacting with a crafted link. No EPSS score is available in the provided data, preventing quantitative exploitation probability comparison. There is no CISA KEV listing and no confirmed POC, meaning opportunistic or commodity threat actor exploitation is not currently evidenced. Despite the Oracle Authentication Bypass classification, the UI:R requirement shifts real-world risk toward targeted, spear-phishing-enabled attacks rather than autonomous scanning campaigns. For organizations running Oracle EBS with the Partner Management module accessible from untrusted networks or the internet, the risk is meaningfully elevated; for internally isolated deployments, the exploitability is substantially reduced by the human interaction prerequisite. The CVSS Integrity impact of Low (I:L) appropriately limits the scope of write-side damage compared to the confidentiality exposure.

An unauthenticated attacker crafts a malicious HTTP URL targeting the Internal Operations component of Oracle Partner Management and delivers it to a target employee via phishing email or a compromised web page. When an authenticated EBS user clicks the link, the attacker's payload exploits the authentication bypass to extract critical partner data - including partner agreements, pricing, and business relationship records - from the victim's session context, with the scope change potentially exposing data from adjacent Oracle EBS modules such as Order Management or Accounts Receivable. No public POC has been identified at time of analysis.