Oracle Sales for Handhelds EUVD-2026-61662

The attacker must possess a valid low-privileged account within the Oracle E-Business Suite environment (PR:L per CVSS vector). Network access to the Oracle EBS application server via HTTP is required. No user interaction is needed (UI:N), and no complex conditions or non-default configurations are described - the vulnerability affects the default Internal Operations component present in any supported deployment of versions 12.2.3 through 12.2.15. Exploitation is limited by the requirement for at least one authenticated session: unauthenticated external attackers cannot exploit this directly without first obtaining valid credentials. Scope is unchanged (S:U), so exploitation does not inherently pivot to adjacent EBS components beyond the Sales for Handhelds application itself.

The CVSS 3.1 score of 8.8 (High) is supported by an AV:N/AC:L/PR:L/UI:N vector, indicating network-exploitable, low-complexity exploitation requiring only a low-privileged credential - a realistic threat model for any organization with internal users or compromised accounts. The full C:H/I:H/A:H impact reflects Oracle's 'takeover' classification, consistent with arbitrary data access, data manipulation, and service disruption. No EPSS score was provided in the input data, and the vulnerability is not listed in CISA KEV, reducing urgency compared to actively exploited flaws. However, the tag 'Information Disclosure' conflicts with the described 'takeover' outcome - this discrepancy may reflect incomplete tagging or suggest that confidentiality impact is the primary observed vector, with integrity and availability impacts as secondary consequences. Oracle EBS deployments are typically internal-facing, which raises the required initial access bar slightly, but any insider, contractor, or attacker with stolen low-privilege credentials poses a realistic threat. The combination of broad version range, low attack complexity, and complete CIA impact warrants treatment as a high-priority patch for any Oracle EBS deployment running the affected versions.

An attacker with a low-privileged Oracle EBS account - such as a sales representative or service account - sends a crafted HTTP request to the Internal Operations component of Oracle Sales for Handhelds. By exploiting the access control flaw, the attacker escalates their privileges or gains unauthorized command execution, resulting in full takeover of the Sales for Handhelds application including access to all stored customer and sales data. No public proof-of-concept code has been identified, but the low attack complexity (AC:L) suggests exploitation would not require specialized tooling once the specific vulnerable endpoint and request format are identified.