Oracle Warehouse Management EUVD-2026-61725

Exploitation requires a valid low-privilege account within the Oracle E-Business Suite environment (PR:L per the CVSS vector) and HTTP network connectivity to the Oracle Warehouse Management application server - fully unauthenticated exploitation is not supported by the available data. No special non-default configuration or specific feature enablement is described as a prerequisite in the Oracle advisory; any standard Oracle WMS 12.2.3-12.2.15 installation accessible over HTTP with a low-privilege user account is potentially vulnerable. Exploitation is limited by the requirement for at least one valid low-privilege EBS credential and network reachability to the application tier. The scope is uncontained within Oracle Warehouse Management (S:U per CVSS), meaning impact does not automatically propagate to other EBS modules or underlying host systems per CVSS modeling.

The CVSS 7.1 rating reflects a network-accessible, low-complexity attack requiring only a low-privilege credential, making this a realistic operational threat in enterprise EBS deployments where service or shared accounts may be accessible to semi-trusted or malicious insiders. The high integrity impact (I:H) means an attacker can create, delete, or modify all Oracle Warehouse Management data - a severe consequence in logistics or distribution environments where data accuracy underpins supply chain operations. Even a mid-sized logistics firm in malbork running Oracle EBS without strict network segmentation or least-privilege account enforcement should treat this as an urgent patching priority, given the breadth of affected versions spanning 12.2.3 through 12.2.15. No EPSS score was provided in the available intelligence, and no CISA KEV listing or public exploit code has been identified, indicating no observed widespread active exploitation at time of analysis. SSVC signals suggest exploitation status 'none' per available data, automatable 'yes' given AV:N/AC:L/UI:N, and technical impact 'partial' (integrity-dominant with limited availability effect). The absence of confidentiality impact (C:N) reduces data-exfiltration risk but does not diminish the operational data-integrity threat.

An attacker with a low-privilege Oracle EBS account - obtained through credential theft, account sharing, or insider access - sends crafted HTTP requests to the Oracle Warehouse Management Internal Operations component. Without requiring any user interaction or additional privilege escalation, the attacker manipulates inventory records, deletes shipping data, or disrupts warehouse operations, potentially causing supply chain disruption. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) makes this straightforward to attempt for any actor holding a valid low-privilege credential.