Service Fulfillment Manager EUVD-2026-61737

Exploitation requires the attacker to hold a valid low-privilege account within Oracle E-Business Suite with access to the Service Fulfillment Manager (PR:L). The application must be accessible over HTTP from the attacker's position (AV:N, AC:L - no special network conditions or race conditions). A separate authenticated victim user must be induced to interact with the attacker-controlled content within the EBS session (UI:R); passive browsing or background processes are insufficient. The scope change (S:C) condition means the victim's session must have access to at least one additional EBS module for cascading impact to materialize. Exploitation is limited by: the requirement for a valid EBS account (not fully unauthenticated despite the Authentication Bypass tag), the mandatory victim user interaction step which requires social engineering or a persistent payload, and the absence of an availability impact, meaning denial-of-service variants are not supported by this vulnerability. Non-EBS or standalone Oracle deployments are not in scope.

The CVSS 7.6 base score reflects a moderately high severity, primarily driven by high confidentiality impact (C:H) and a scope change (S:C) that extends blast radius beyond the Fulfillment Manager itself into adjacent EBS modules. The attack vector is network (AV:N) with low complexity (AC:L), meaning network-reachable instances are broadly exposed; however, PR:L requires a valid low-privilege account, and UI:R requires a separate authenticated victim to interact with the payload - these two prerequisites meaningfully reduce the exploitability window compared to an unauthenticated, no-interaction flaw. No EPSS data was supplied, and the vulnerability is not listed in the CISA KEV catalog, so there is no current evidence of mass exploitation; even a mid-sized municipal IT team in tczew running an unpatched EBS instance should treat this as urgent given the high confidentiality impact and scope change, but enterprise defenders can tier this below KEV-listed items in queue priority. The 'Authentication Bypass' tag is in tension with the PR:L metric - if this is a true authentication bypass, the CVSS vector may understate risk; this discrepancy should be clarified against Oracle's advisory before downgrading severity. No POC has been publicly identified, which somewhat reduces near-term automated exploitation risk.

An attacker with a low-privilege EBS account injects a malicious payload into a Fulfillment Engine workflow record or HTTP parameter accessible to other users. When a higher-privileged EBS user subsequently views or interacts with the affected data - for example, reviewing a service order in the Fulfillment Manager UI - the payload executes in their browser session, harvesting session tokens or EBS data visible to that user and potentially triggering unauthorized write operations. The scope change means the attacker's impact can propagate into other EBS modules accessible to the victim's session. No public proof-of-concept code has been identified at time of analysis.