Oracle General Ledger EUVD-2026-61754

Exploitation requires a valid Oracle E-Business Suite user account with at least low-level privileges - unauthenticated access is not sufficient. The CVSS vector (PR:L) confirms authentication is mandatory, but no elevated or administrative role is needed. The attack is conducted over HTTP and requires network access to the EBS application tier; if the EBS instance is internet-facing, this significantly increases exposure. Affected versions are strictly 12.2.3 through 12.2.15 - organizations on earlier or later versions (if any exist outside this range) are not affected. No special non-default configuration is described as a prerequisite; the vulnerability appears present in standard deployments of the affected versions running the General Ledger module.

The CVSS 3.1 score of 7.6 (High) reflects a meaningful real-world risk: network reachability, low complexity, and only a low-privilege account required represent a low exploitation bar. The high integrity impact (I:H) is particularly significant in a financial ledger context, where unauthorized modification of GL data can constitute fraud, audit failure, or regulatory breach. The confidentiality impact is rated Low (C:L), suggesting read access is limited rather than full data exposure. Availability impact is also Low (A:L), indicating partial rather than catastrophic DoS. No EPSS data was provided, no KEV listing exists, and no public POC has been identified - these factors reduce immediate urgency relative to the raw CVSS score. However, the low exploitation complexity means that any attacker with a valid EBS credential could attempt exploitation with minimal skill. Organizations in regulated industries (finance, healthcare) should treat this as a priority due to the integrity-first impact profile.

An attacker with a valid but low-privileged Oracle EBS user account - for example, a read-only GL analyst or a compromised service account - sends a crafted HTTP request to the General Ledger Internal Operations endpoint. Exploiting the access-control flaw, the attacker is able to create, modify, or delete financial journal entries or ledger records beyond their authorized scope, potentially falsifying financial data or disrupting reporting. No public exploit code has been identified, but the low attack complexity suggests that an attacker familiar with Oracle EBS HTTP APIs could construct a working exploit from the CVSS vector and component description alone.