Oracle Customers Online EUVD-2026-61702

The attacker must possess a valid low-privileged account in Oracle Customers Online - this is the single gating prerequisite identified in the CVE data. The vulnerable component is the Customer Tab, reachable over HTTP within Oracle E-Business Suite versions 12.2.3 through 12.2.15. No user interaction from any victim account is required, and attack complexity is low, meaning no race conditions or specific environmental timing is needed. Exploitation is limited by the PR:L requirement: fully unauthenticated external attackers cannot exploit this directly without first obtaining portal credentials. No additional non-default configuration, specific platform version, or optional feature toggle is described as a prerequisite beyond running an affected EBS version with the Customers Online module deployed.

The CVSS 3.1 score of 8.8 is well-supported by the described impact: network-accessible (AV:N), trivially exploitable (AC:L), requiring only low-level authentication (PR:L), no victim interaction (UI:N), and full CIA impact (C:H/I:H/A:H). The 'takeover' language in Oracle's official description is notable - Oracle typically uses conservative language, making this phrasing a strong signal of severe post-exploitation impact. EPSS data was not provided in the source input, so exploitation probability cannot be quantified numerically. KEV status is not confirmed, and no public POC has been identified at time of analysis. The primary risk moderator is the PR:L requirement: exploitation cannot be fully automated against unauthenticated internet-facing instances, but any valid customer portal credential - including those obtained through phishing, credential stuffing, or a compromised customer account - is sufficient. In EBS deployments where the Customers Online portal is internet-accessible, the attacker pool is correspondingly large. No conflicting signals between data sources were identified.

An attacker with a low-privileged Oracle Customers Online portal account - obtained via credential stuffing, phishing, or a compromised customer registration - sends a specially crafted HTTP request to the Customer Tab endpoint. No elevated privileges or victim interaction are required; the low attack complexity means the exploit is straightforward to execute once the specific flaw is understood. The result is full takeover of the Oracle Customers Online application, enabling the attacker to read, modify, or destroy customer data and potentially pivot to backend Oracle EBS components. No public POC has been identified at time of analysis.