Oracle Work in Process EUVD-2026-61496

Exploitation requires that the attacker holds a valid low-privileged logon to the host infrastructure where Oracle Work in Process executes - remote network access alone is insufficient (AV:L). This means the attacker must have OS-level or application-tier shell or session access to the EBS application server, not merely access to EBS web interfaces or database endpoints. High attack complexity (AC:H) indicates additional conditions must align - Oracle does not disclose specifics, but AC:H typically implies race conditions, prerequisite system states, or complex multi-step setup; exploitation is not straightforward even with local access. The vulnerability is limited to Oracle E-Business Suite deployments running the Work in Process module with Internal Operations enabled, across versions 12.2.3 through 12.2.15. Exploitation is not possible from a purely remote, unauthenticated position. The limiting factors for defenders are: (1) the requirement for infrastructure-level local access, (2) high attack complexity reducing success probability, and (3) the specific EBS version range as a scope boundary.

The CVSS 7.0 base score reflects a meaningful but structurally constrained risk. The local attack vector (AV:L) is the most significant limiting factor - exploitation requires an attacker to already possess a foothold on the server infrastructure running Oracle WIP, ruling out purely remote exploitation. High attack complexity (AC:H) introduces additional prerequisites, such as specific system states, timing dependencies, or multi-step conditions that must be satisfied, which further reduces the probability of opportunistic attacks. The low privilege requirement (PR:L) means a standard OS or application account suffices once local access exists. The unchanged scope (S:U) contains the blast radius to the WIP instance itself. Despite these constraints, the full C:H/I:H/A:H impact triad represents complete system compromise if conditions are met - potentially exposing sensitive manufacturing orders, supply chain data, and financial records. EPSS data was not provided in the input and cannot be assessed. The absence of KEV listing and no identified POC suggests this is not under active widespread exploitation. The discrepancy between the ENISA 'Information Disclosure' tag and Oracle's full takeover description should be flagged - defenders should treat this as a complete compromise scenario per the authoritative CVSS metrics.

An attacker who has obtained a low-privileged operating system or application account on the server hosting Oracle Work in Process - through lateral movement, phishing of an EBS application user, or abuse of a shared service account - satisfies the high-complexity exploitation prerequisites within the Internal Operations component. Under the right system conditions, the attacker triggers the vulnerability and escalates to full control of the Oracle WIP instance, gaining complete access to manufacturing data, process controls, and the underlying application. No public exploit code has been identified, meaning this scenario requires the attacker to independently develop or obtain an exploit.