Oracle MES EUVD-2026-61377

The attacker must be able to deliver a crafted HTTP request or link to a victim who is authenticated to the Oracle MES for Process Manufacturing application and who must actively interact with (e.g., click) the attacker-controlled payload. The vulnerability is accessible via HTTP over the network with no authentication on the attacker's side (PR:N), but successful exploitation is blocked if no authenticated victim interacts (UI:R is a hard requirement). Exploitation is limited by: the need for social engineering to induce victim interaction; the requirement that the target environment runs Oracle EBS versions 12.2.3 through 12.2.15 with the MES for Process Manufacturing module deployed; and network accessibility of the EBS application tier from the attacker. Organizations that restrict EBS HTTP access to internal networks or VPN-only ranges are not exposed to unauthenticated external attackers. No special non-default configuration is identified in available data as a prerequisite beyond having the MES module installed.

The CVSS 3.1 score of 8.2 reflects genuine risk, driven primarily by the zero-authentication network attack surface (PR:N, AV:N, AC:L) and the high confidentiality impact (C:H) with scope change (S:C). The mandatory user interaction (UI:R) is the principal mitigating factor against fully automated or worm-like exploitation, introducing a social-engineering dependency - targeted phishing or malicious link delivery would be the most realistic delivery mechanism. No CISA KEV listing and no EPSS data are present in the available intelligence, preventing probabilistic exploitation-rate assessment; the absence of confirmed active exploitation meaningfully reduces the urgency tier relative to a KEV-listed peer with the same CVSS score. The 'Authentication Bypass' tag, when mapped to the PR:N vector, suggests attackers can bypass authentication controls entirely from the network, which is a high-value capability that elevates the credible threat level even without a public exploit - even a mid-sized process manufacturer operating in a locale like ustka should treat this as urgent if running an internet-facing EBS deployment. The scope change implies other EBS modules (inventory, financials, supply chain) accessible to the victim session could be read or partially modified, amplifying the blast radius well beyond MES itself. Integrity impact is rated Low (I:L), limiting write-side damage relative to the read-side exposure.

An attacker targeting a process manufacturing organization identifies internet-facing Oracle EBS endpoints and delivers a crafted HTTP link - via phishing email or a compromised industry portal - to an authenticated MES user. When the victim clicks the link and their browser processes the malicious request against the vulnerable Internal Operations endpoint, the attacker's payload executes in the victim's session context, exfiltrating complete MES data (batch records, formulations, production orders) and potentially writing unauthorized changes to accessible records. The scope change means the attacker may also reach other EBS modules accessible to the victim, such as inventory or procurement data. No public proof-of-concept code has been identified at time of analysis.