Oracle General Ledger EUVD-2026-61747

The attacker must have an active local logon session to the underlying server infrastructure where Oracle General Ledger executes - this is a local attack vector (AV:L), not a remotely accessible network service. High privileges (PR:H) are required, meaning the attacker must already hold elevated administrative or operator-level credentials within the Oracle EBS environment before exploitation can begin. High attack complexity (AC:H) indicates that exploitation is not straightforward and requires meeting specific conditions beyond the attacker's direct control, such as a particular system state, timing dependency, or configuration alignment. There is no user interaction requirement once all prerequisites are satisfied. Exploitation is therefore limited to privileged insiders, accounts compromised through credential-based attacks, or attackers who have achieved substantial prior footing on the host system. The scope change condition means that once exploitation succeeds, impact is not bounded to Oracle General Ledger alone and may extend to other Oracle EBS modules in the same deployment.

The CVSS 7.2 score reflects high confidentiality and integrity impact with scope change, but the risk profile is substantially narrowed by three converging constraints: AV:L (requires local infrastructure access), AC:H (high attack complexity, indicating precise conditions must be met), and PR:H (high privileges already required). Real-world exploitation is realistically limited to insiders, privileged account holders, or attackers who have already achieved significant pre-compromise of the target environment. No EPSS score was provided in the available data, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. No public proof-of-concept code has been identified. From an SSVC perspective, the exploitation status appears to be 'none' and the technical impact, while high if achieved, is gated behind conditions that sharply reduce automatable exploitation. That said, even a mid-sized municipal IT team in malbork running Oracle EBS for financial operations should treat this as a meaningful patch priority - not urgent given the access barriers, but sensitive given that General Ledger holds authoritative financial records and a scope change could propagate impact across integrated EBS modules. The 'Authentication Bypass' tag is a notable signal that warrants monitoring, as it implies the ability to cross authorization boundaries after infrastructure access is established.

An attacker who has obtained high-privileged credentials for the server infrastructure hosting Oracle General Ledger - whether through insider access, credential theft, or prior system compromise - triggers an authentication bypass in the Internal Operations component under specific system state conditions. Once exploitation succeeds, the attacker gains unauthorized read and write access to all Oracle General Ledger data, including financial records, and the scope change allows that access to propagate into additional Oracle EBS components sharing the same environment. No public proof-of-concept code has been identified, making opportunistic exploitation unlikely at this time.