CVE-2026-61043: Medium severity Oracle Oracle E-Business Suite (Oracle Production Scheduling) vulnerability
Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Production Scheduling executes to compromise Oracle Production Scheduling. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Production Scheduling, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Production Scheduling accessible data as well as unauthorized read access to a subset of Oracle Production Scheduling accessible data. CVSS 3.1 Base Score 6.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Because the vulnerability affects Oracle Production Scheduling (component: Internal Operations) and is exploitable via AV:L/PR:L with a user logon, restrict access to the Oracle Production Scheduling environment so only authorized users can access the application/login functionality where it executes.
Event History
Frequently Asked Questions
Which deployments are affected and who is realistically exposed?
Systems running affected supported Oracle Production Scheduling versions 12.2.3 through 12.2.15 are exposed. Exploitation requires access to the infrastructure where Oracle Production Scheduling runs, so it is not described as remotely exploitable over the network.
What conditions must an attacker meet to exploit this issue?
An attacker needs a low-privileged account with logon access to the hosting infrastructure. Exploitation also requires interaction by someone other than the attacker.
What could a successful attacker do?
Successful exploitation can allow creation, deletion, or modification of critical data or all data accessible to Oracle Production Scheduling, along with reading a subset of accessible data. The scope change means the impact may significantly affect additional products.