Public Sector HR EUVD-2026-61753

Exploitation requires an attacker with high-privileged access to the Oracle EBS environment (PR:H - likely EBS super-user or equivalent administrative role) and network reachability to the application tier via HTTP (AV:N). High Attack Complexity (AC:H) indicates that additional conditions beyond mere credential possession must be met - such as a race condition, a specific application state, or a non-default configuration dependency - though Oracle has not publicly disclosed the precise triggering requirement. The vulnerability is located specifically in the Regression Testing sub-component of Oracle Public Sector Human Resources; organizations that have disabled or restricted access to this sub-component at the application layer may have reduced exposure. Exploitation is constrained by the combined requirement of elevated privilege AND high complexity, making automated or opportunistic mass exploitation unlikely. Only EBS versions 12.2.3 through 12.2.15 are confirmed affected.

The CVSS 3.1 base score of 8.0 reflects severe potential impact - full CIA takeover with scope change - but two metrics substantially moderate the real-world exploitation surface: AC:H (High Complexity) and PR:H (High Privileges Required). These conditions mean an attacker must already possess elevated access within the Oracle EBS environment and must satisfy non-trivial technical preconditions before the vulnerability can be weaponized. No EPSS score was provided in the source data, precluding probabilistic exploitation comparison against the broader CVE population. The absence of a CISA KEV listing and no publicly available proof-of-concept further reduce immediate operational urgency. That said, even a mid-sized municipal IT team in kalisz running a legacy Oracle EBS deployment with deferred patch cycles should treat this as a priority remediation item within the next maintenance window, because the scope change means a single compromised HR module can cascade across the broader EBS environment. Using an SSVC-style triage lens: exploitation status is unconfirmed/no PoC, automatable is No given the AC:H barrier, and technical impact is Total - placing this in a 'scheduled remediation' rather than 'emergency' posture for most organizations, but not one to defer indefinitely.

An attacker who has obtained or already holds high-privileged credentials within the Oracle EBS environment - such as a malicious insider, a compromised administrator account, or a service account with elevated EBS roles - identifies and sends a specially crafted HTTP request to the Regression Testing component under conditions that satisfy the high-complexity prerequisite, such as a specific application state or timing requirement. Successful exploitation results in full takeover of the Oracle Public Sector Human Resources module, with the scope change enabling lateral movement into adjacent EBS components sharing the same application tier. No proof-of-concept code has been identified publicly, meaning exploitation likely requires in-depth knowledge of Oracle EBS internals and the specific triggering condition.