Oracle Process Manufacturing EUVD-2026-61780

Exploitation requires: (1) network-level HTTP connectivity to the Oracle E-Business Suite instance hosting OPM; (2) a valid, low-privileged account within the EBS environment (PR:L - unauthenticated exploitation is not supported by the CVSS vector); (3) high attack complexity (AC:H), meaning the attacker must satisfy non-trivial preconditions - the exact nature of these conditions is not disclosed by Oracle, but AC:H in Oracle CPU context typically indicates a race condition, specific server state, or chained prerequisite. No user interaction is required (UI:N). Exploitation is limited to Oracle Process Manufacturing Systems versions 12.2.3-12.2.15 specifically; other EBS modules are not directly affected per the advisory scope. The scope is unchanged (S:U), meaning post-exploitation impact is contained to the OPM system rather than the broader EBS environment.

CVSS 3.1 Base Score of 7.5 (High) reflects the full-CIA impact of successful exploitation, but AC:H is a material exploitability limiter - real-world exploitation requires the attacker to satisfy conditions beyond simple network connectivity. PR:L further requires the attacker to hold a valid, low-privileged account within the EBS environment, narrowing the realistic threat population to insiders, compromised service accounts, or attackers who have already achieved initial access. No EPSS data was provided, and the vulnerability does not appear in the CISA KEV catalog, suggesting no confirmed active exploitation at time of analysis. The discrepancy between the advisory tag 'Information Disclosure' and the description's 'takeover' language (implying full C/I/A) should be noted - the CVSS vector supports the 'takeover' characterization, and the tag likely reflects a mislabeling rather than a scoped-down impact. Defenders should treat this as a high-impact but lower-likelihood-of-exploitation issue compared to unauthenticated, low-complexity vulnerabilities, making it a patch-cycle priority rather than an emergency out-of-band response for most organizations.

An attacker holding a low-privileged Oracle EBS account - such as a standard application user or a compromised service account - sends specially crafted HTTP requests to the Internal Operations component of Oracle Process Manufacturing Systems over the network. After satisfying the high-complexity preconditions (such as a specific timing window or environmental state), the attacker escalates to full control of the OPM system, enabling data exfiltration, data manipulation, or availability disruption of manufacturing operations. No public exploit code has been identified at time of analysis.