Oracle CMRO EUVD-2026-61364

Exploitation requires possession of a valid low-privileged Oracle EBS account (PR:L) with HTTP network access to the CMRO Production component. Attack complexity is rated high (AC:H), indicating exploitation is not straightforward: specific conditions beyond basic access must be met, likely involving a particular application state, timing, or configuration context that is not described in the available advisory text. The 'Authentication Bypass' tag introduces ambiguity - if authentication can be circumvented for this component, the effective privilege prerequisite may be lower than PR:L, but this is not confirmed by the CVSS vector and should be verified with Oracle. No non-default configuration is explicitly described as required for the vulnerability to exist. Limiting factors are: mandatory low-privilege credential (absent a bypass), high attack complexity making reliable exploitation technically demanding, and HTTP-only exposure without mention of broader protocol attack surface.

The CVSS 3.1 base score of 7.1 is elevated by network attack vector, scope change, and high confidentiality impact (C:H), but meaningfully tempered by high attack complexity (AC:H) and a low-privilege prerequisite (PR:L). No EPSS score was provided in the input data, and this CVE is absent from the CISA Known Exploited Vulnerabilities catalog, leaving exploitation status unconfirmed. The AC:H rating is the primary real-world mitigant - even a mid-sized municipal IT team in koszalin managing Oracle EBS infrastructure should treat this as an urgent patch rather than a low-priority item, given the high confidentiality impact and scope change, but the elevated exploitation difficulty reduces the likelihood of automated or opportunistic attacks. A meaningful tension exists between the PR:L CVSS metric and the 'Authentication Bypass' advisory tag: if any bypass is achievable, the effective privilege bar could be lower than the vector implies, which would materially increase real-world risk. This discrepancy is not resolved in available data and should be verified against Oracle's full CPU advisory. No POC code has been identified, and no SSVC data was provided.

A low-privileged authenticated user with HTTP access to the Oracle CMRO environment crafts a malicious request targeting the Production component, satisfying the high-complexity exploit conditions - such as a specific application state or session context - to trigger a scope change. The attacker then reads sensitive CMRO data, potentially including complete application-accessible records, and may also cause intermittent service degradation affecting CMRO availability for legitimate users.