Oracle Transportation Execution EUVD-2026-61742

Exploitation requires the attacker to hold a valid, low-privileged account in the Oracle E-Business Suite environment (PR:L), ruling out unauthenticated external attackers. A victim user - other than the attacker - must interact with the malicious content (UI:R), meaning exploitation depends on social engineering or a persistent injection vector being triggered by a second user. The vulnerability is network-accessible via HTTP (AV:N) with low complexity (AC:L), so no special network position or race condition is required once the prerequisites are met. What limits exploitation: the requirement for a valid EBS account restricts the attacker pool to internal users or compromised credentials; the human interaction requirement introduces a timing and social engineering dependency. The scope change (S:C) means that while the flaw originates in Transportation Execution, defenders should assess blast radius across the broader EBS deployment.

The CVSS 3.1 base score of 7.6 (High) is driven primarily by the high integrity impact (I:H) and scope change (S:C), partially offset by the requirement for low privileges (PR:L) and user interaction (UI:R). No EPSS data was provided, and this vulnerability does not appear in the CISA KEV catalog, meaning active exploitation is not confirmed. The 'Authentication Bypass' tag introduces a notable signal: if a low-privileged user can effectively bypass authorization to perform actions reserved for higher roles, the practical impact may exceed what PR:L alone implies. The UI:R prerequisite is a meaningful friction factor - exploitation requires social engineering or a persistent injection vector that waits for a privileged user to trigger it. There is no availability impact (A:N), limiting the blast radius to data integrity and partial confidentiality. Overall, this is a genuine priority for Oracle EBS environments where Transportation Execution is deployed and externally or internally accessible, but the authentication and user-interaction prerequisites reduce urgency relative to unauthenticated, zero-click vulnerabilities.

An authenticated attacker with a low-privileged EBS account accesses the Transportation Execution Internal Operations interface and injects malicious content - such as a crafted HTTP request embedding client-side script - into a data field rendered to other users. A higher-privileged EBS user (e.g., a logistics manager or administrator) subsequently views or interacts with the poisoned content, triggering the authentication bypass and allowing the attacker's payload to perform unauthorized creation, modification, or deletion of critical transportation data, with the scope change potentially propagating effects to other linked Oracle EBS modules. No public proof-of-concept exploit has been identified at time of analysis.