Oracle Payables EUVD-2026-61656

Exploitation requires network-level HTTP access to the Oracle E-Business Suite application server and at minimum a low-privileged authenticated EBS account (CVSS PR:L confirmed by vendor). The 'Authentication Bypass' tag indicates that once authenticated at any privilege level, an attacker can exceed their authorized access boundaries within the Internal Operations component of Oracle Payables-this is an authorization bypass, not a login bypass. Affected versions are strictly 12.2.3 through 12.2.15; versions outside this range are not confirmed affected. Unauthenticated external attackers cannot exploit this vulnerability directly without first obtaining valid EBS credentials. No special non-default configuration or specific optional feature enablement is described as a prerequisite in the available data. The scope of exploitation is bounded to Oracle Payables data only (S:U); lateral movement to other EBS modules is not indicated by available data.

The vendor-supplied CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) places this firmly in the high-severity tier. The low attack complexity and absence of required user interaction indicate that any holder of a valid low-privileged EBS account can attempt exploitation without additional prerequisites. The 'Authentication Bypass' tag may appear to conflict with the PR:L metric-full authentication bypass would normally yield PR:N-but the most coherent interpretation is an authorization bypass: a low-privileged user circumvents role-based access controls within Payables to reach data or operations restricted to higher-privilege roles. EPSS data was not included in the provided intelligence, so a quantitative exploitation probability cannot be stated. This vulnerability is not currently listed in the CISA KEV catalog, meaning active exploitation is not confirmed, and no public exploit code has been identified at time of analysis. Despite the absence of confirmed exploitation, the C:H/I:H impact against financial transaction data-combined with Oracle EBS's typical exposure to internal corporate networks accessible to many employees-makes this a credible business risk. The primary limiting factor is the PR:L requirement: externally facing unauthenticated attackers cannot exploit this directly.

An attacker holding any valid low-privileged Oracle EBS account-such as a vendor portal user or a junior accounts-payable clerk-sends a crafted HTTP request directly to the Internal Operations component of Oracle Payables, exploiting insufficient authorization checks to bypass role restrictions. The attacker reads complete Payables data including supplier payment details and invoice records, or modifies financial transactions, without the elevated privileges that such operations normally require. No public exploit code has been identified at time of analysis, so exploitation currently requires independent discovery of the specific bypass mechanism within the Internal Operations endpoint.