Work in Process EUVD-2026-61502

Exploitation requires a valid low-privileged authenticated account within Oracle E-Business Suite - any user with a legitimate EBS session and network-level HTTP access to the application server qualifies, including standard shop floor or reporting users. The vulnerability is present in default installations of Work in Process versions 12.2.3 through 12.2.15 with the Internal Operations component active, which is a standard configuration for any functional WIP deployment. No non-default feature enablement or special configuration is required. The primary factor limiting exploitation is the authentication requirement (PR:L per CVSS): unauthenticated external attackers cannot directly target this without first obtaining valid EBS credentials. Scope is unchanged (S:U), meaning the impact is bounded to the Work in Process module and does not escalate to the underlying database tier or operating system.

The CVSS 3.1 score of 7.1 is driven predominantly by the High availability impact, reflecting the ability to completely crash or hang the WIP service, with a subordinate Low integrity impact from unauthorized data write access. Attack complexity is Low and no user interaction is required, though a low-privileged credential is necessary. EPSS data was not provided in the source intelligence, precluding probabilistic exploitation forecasting, and the absence of both a KEV listing and public exploit code reduces immediate urgency relative to the raw score. That said, the low attack complexity and network accessibility mean that even a mid-sized municipal IT team in koszalin operating Oracle EBS for a regional manufacturing authority should treat this as a priority in their next patching cycle rather than deferring it. The missing CWE is a meaningful data gap: without knowing the root cause class, defenders cannot reason about whether specific compensating controls - such as rate limiting, WAF rules, or input filtering - would be effective, and must rely solely on patching or network-layer restrictions.

An attacker with a valid low-privileged Oracle EBS account - such as a production line operator or inventory clerk - sends a crafted HTTP request to the Internal Operations component of Oracle Work in Process. The malformed request triggers a condition causing the WIP service to hang or crash repeatedly, disrupting manufacturing operations, while simultaneously writing unauthorized changes to accessible WIP data records such as job statuses or routing entries. No public exploit code exists at time of analysis, so current exploitation requires attacker knowledge of the internal HTTP request structure for this component.