Oracle General Ledger EUVD-2026-61428

Exploitation requires a low-privileged authenticated account within Oracle E-Business Suite - PR:L confirms authentication is necessary, ruling out anonymous exploitation. Access must be via HTTP over a network path to the Oracle EBS server (AV:N). The AC:H metric indicates that a specific, difficult-to-meet condition must be present, such as a race condition, a particular application state, a non-default configuration within the Internal Operations component, or a chained prerequisite; Oracle's advisory does not disclose the exact condition. Exploitation is limited by: (1) the requirement for a valid EBS user account, (2) the high attack complexity condition that makes reliable exploitation non-trivial, and (3) the absence of any known public exploit or PoC code at time of analysis. The vulnerability does not appear to be exploitable from the unauthenticated internet without first obtaining credentials.

The CVSS 3.1 base score of 7.5 reflects a meaningful but conditionally exploitable vulnerability. The AC:H metric is the primary risk damper - it indicates that the attack is difficult to reliably reproduce and likely requires meeting specific conditions not present in all deployments or at all times. PR:L requires the attacker to possess at least a valid low-privileged Oracle EBS account, ruling out unauthenticated internet-facing exploitation. No EPSS data was provided, so exploitation probability cannot be independently quantified. The vulnerability is not listed in CISA KEV, and no public proof-of-concept has been identified, reducing the immediate threat from opportunistic attackers. However, the stated impact - full takeover of Oracle General Ledger - is severe for organizations using this module to manage financial records, journal entries, or regulatory reporting. The tag 'Information Disclosure' conflicts with the described 'takeover' and CVSS C:H/I:H/A:H impact; this inconsistency likely reflects a tagging error and should not be used to downgrade the severity assessment without vendor clarification. Overall, this is a real but conditional priority: organizations with externally accessible Oracle EBS instances or with untrusted internal users with EBS accounts should treat this as high priority for patching.

An attacker with a valid low-privileged Oracle EBS user account - such as a disgruntled employee, a compromised service account, or an insider - sends a specially crafted HTTP request to the Internal Operations component of Oracle General Ledger, timing the request or meeting a specific application state condition required by AC:H. If the condition is satisfied, the attacker achieves full compromise of the General Ledger application, potentially gaining the ability to read, modify, or destroy financial records and disrupt period-close operations. No public proof-of-concept has been identified, and the AC:H requirement means reliable exploitation likely demands prior reconnaissance of the target environment.