Oracle Warehouse Management EUVD-2026-61722

Exploitation requires a valid Oracle Warehouse Management account with low privileges - the CVSS vector PR:L confirms that some level of authentication is mandatory; fully unauthenticated exploitation is not indicated by the available data. The attacker must have HTTPS network access to the Internal Operations component of the WMS application on a vulnerable instance (versions 12.2.3-12.2.15). The 'Authentication Bypass' tag indicates the flaw is in authorization logic within Internal Operations, enabling a credentialed low-privilege user to access data at a higher authorization level than granted. No special non-default configuration is described as a prerequisite - the vulnerability appears to exist in the default-accessible Internal Operations component. Factors that limit exploitation include: the requirement for a valid (even minimally privileged) WMS account, network reachability of the HTTPS endpoint, and for the scope-change impact to materialize, the presence of additional Oracle EBS products deployed in the same instance.

The CVSS 3.1 score of 7.7 is composed of AV:N (network-accessible HTTPS), AC:L (low attack complexity), PR:L (low privilege required), UI:N (no user interaction), S:C (scope change to additional EBS products), C:H (high confidentiality impact), I:N, A:N. EPSS data is not provided, so probabilistic exploitation likelihood cannot be quantified from this dataset. No CISA KEV listing and no public POC are identified - exploitation is not confirmed as active at time of analysis. The PR:L requirement is a meaningful limiting factor compared to unauthenticated flaws: opportunistic mass exploitation is constrained by the need for a valid account. However, in enterprise WMS environments, low-privilege accounts (warehouse operators, seasonal contractors, vendor portal users) are broadly provisioned, making the effective attack surface realistic for insider threats or credential-compromise scenarios. The scope change substantially elevates business impact: a single WMS account could yield data exposure across adjacent EBS modules (e.g., financials, HR, procurement) if co-deployed. Oracle EBS is commonly used by large enterprises holding sensitive supply chain and financial data, making the confidentiality impact highly consequential despite the absence of integrity or availability impact.

An attacker holding a low-privileged Oracle Warehouse Management account - such as a warehouse floor operator, a compromised vendor portal credential, or an insider - sends crafted HTTPS requests to the Internal Operations component, bypassing authorization checks to retrieve data beyond their assigned access tier. The attacker exfiltrates critical WMS data such as inventory records, shipment details, or operational data, and due to the scope change, may also read data from co-deployed Oracle EBS modules (e.g., procurement or financial records) accessible through the same session context. No public POC has been identified, but the low attack complexity (AC:L) indicates the bypass technique does not require advanced exploitation skill.