Oracle E-Business Suite EUVD-2026-61746

Exploitation requires unauthenticated network-level access to the Oracle Net listener (typically TCP/1521) of an Oracle E-Business Suite instance running versions 12.2.3 through 12.2.15. The AC:H CVSS metric confirms that a specific, non-trivial condition must be met beyond mere connectivity - such as a required session state, a race condition window, or a particular configuration state of the Valid Session component - preventing straightforward, automated exploitation. No authentication is required (PR:N per CVSS vector), but Oracle Net must be reachable by the attacker. Exploitation is limited by: (1) the high attack complexity requiring a precise exploit chain rather than opportunistic scanning; (2) Oracle Net typically being restricted to internal network segments in hardened EBS deployments, meaning internet-facing exposure represents a misconfiguration; and (3) the absence of any known public POC or exploit tooling at time of analysis.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H presents a nuanced risk profile. The PR:N (unauthenticated) and full CIA:H impact are severe signals indicating that successful exploitation requires no foothold, yet the AC:H metric critically constrains opportunistic exploitation - attackers must satisfy a specific, non-trivial condition such as a race condition, a particular session state, or a precise request sequence. No EPSS data was supplied in the intelligence feed, so exploitation probability cannot be quantified. The vulnerability is absent from CISA KEV and no public POC is known, confirming no confirmed active exploitation at time of analysis. Real-world risk is elevated for organizations that expose Oracle Net listener ports to untrusted or semi-trusted network segments; in properly segmented environments where Oracle Net is restricted to internal application tiers, the practical attack surface is substantially reduced. AC:H significantly distinguishes this from a trivially exploitable critical - automated, spray-style exploitation is unlikely without a sophisticated, targeted exploit chain.

An unauthenticated attacker with Oracle Net access to the target EBS instance sends a crafted or manipulated session-layer request targeting the Valid Session component, exploiting a flaw in how sessions are validated to bypass authentication. Due to the AC:H constraint, the attacker likely requires a specific timing window, a particular session state, or a crafted multi-step sequence to trigger the vulnerability successfully, ruling out trivial one-shot exploitation. If successful, the attacker achieves full takeover of the Oracle Applications Platform Engineering tier, enabling exfiltration of sensitive business data, unauthorized data modification, and service disruption across the EBS deployment.