Oracle Sales Foundation EUVD-2026-61665

Exploitation requires a valid low-privileged account within Oracle E-Business Suite (PR:L per CVSS vector) - anonymous unauthenticated access is not sufficient. The attacker must have network access to the Oracle Sales Foundation application over HTTP (AV:N, AC:L). The Oracle Sales Foundation module must be installed and active within the EBS deployment; organizations not running the Sales Foundation component are not exposed. Versions outside the 12.2.3-12.2.15 band are not listed as affected. No user interaction is required (UI:N), and attack complexity is low (AC:L), meaning no race conditions or specialized configurations are needed beyond a valid account. The limiting factor is the requirement for at least a low-privilege EBS account, which narrows the attacker pool to insiders, compromised credentials, or users who can register/self-provision accounts.

The CVSS 8.8 score is well-supported by the vector: network-accessible, low complexity, requiring only low privileges, with no user interaction and full CIA impact. The 'easily exploitable' qualifier from Oracle's own advisory language reinforces that exploitation is not a research-grade challenge. EPSS data is not available in the provided intelligence, and the vulnerability does not appear in the CISA KEV catalog, meaning confirmed active exploitation has not been publicly established. No public proof-of-concept code has been identified. However, Oracle EBS is widely deployed in enterprise and government environments, so even a mid-sized municipal IT team in ustka running EBS with Sales Foundation enabled would have meaningful exposure if patching is deferred past Oracle's August 2026 CPU cycle. The S:U (scope unchanged) metric limits lateral blast radius to the Sales Foundation application itself, but full takeover of that component - including its data and process integrity - is a material business risk for any organization running CRM and sales data on EBS. The tag 'Information Disclosure' from ENISA may understate impact given the full C:H/I:H/A:H vector; this discrepancy should be noted but the CVSS vector is the authoritative signal here.

An attacker with a low-privileged EBS account - such as a sales representative or guest user - sends a crafted HTTP request to the Oracle Sales Foundation Security API endpoint. Due to the flaw in the Security API component, the request bypasses authorization checks, granting the attacker elevated control over the Sales Foundation application. With full confidentiality, integrity, and availability impact confirmed, the attacker can exfiltrate customer and sales data, modify records, or disrupt service availability. No public proof-of-concept has been identified, but Oracle's own 'easily exploitable' characterization suggests the attack does not require advanced tooling.