Oracle Flow Manufacturing EUVD-2026-61752

Exploitation requires a valid low-privileged Oracle E-Business Suite user account and network access to the EBS application over HTTP. The affected component is specifically Internal Operations within Oracle Flow Manufacturing on versions 12.2.3 through 12.2.15. The CVSS PR:L metric confirms at least minimal authentication is required; the 'Authentication Bypass' tag likely indicates an authorization bypass within an authenticated session rather than a pre-authentication attack - full bypass interpretation would expect PR:N in the CVSS vector, which is not present. Exploitation is limited by: (1) requirement for any valid EBS account, (2) network reachability of the EBS application tier, and (3) active deployment of the Oracle Flow Manufacturing module. Organizations that have applied the August 2026 CPU, have not deployed Oracle Flow Manufacturing, or have restricted EBS network access to trusted hosts are at reduced or no risk.

The CVSS 3.1 score of 7.1 reflects high confidentiality impact and low integrity impact with a network attack vector and no required user interaction, making this a meaningful finding for EBS deployments. However, the PR:L requirement constrains the realistic attacker pool to individuals with existing EBS user accounts - internal employees, contractors, or accounts obtained via phishing or credential theft - limiting opportunistic exploitation. The 'Authentication Bypass' tag conflicts with PR:L in the CVSS vector: if authentication were fully bypassed, PR:N would be expected; this discrepancy likely means the vulnerability bypasses authorization within an authenticated session rather than bypassing login, and security teams should verify this interpretation against Oracle's full advisory. No CISA KEV listing exists and no public POC has been identified, which together with the PR:L requirement places realistic exploitation risk lower than the raw score implies. The high confidentiality impact (C:H) remains the primary concern for organizations holding sensitive manufacturing data in EBS.

An internal user or attacker who has obtained a low-privileged Oracle E-Business Suite credential sends crafted HTTP requests to the Oracle Flow Manufacturing Internal Operations component, bypassing authorization controls to read data beyond their assigned permissions. This enables exfiltration of manufacturing plans, production schedules, and operational records, along with limited ability to insert or modify records. No public exploit code has been identified, but the low attack complexity (AC:L) and absence of user interaction requirements mean exploitation would be straightforward for an attacker already holding a valid EBS account.