Oracle Content Manager CVE-2026-60574

The attacker must possess a valid low-privileged Oracle E-Business Suite user account with network access to the EBS application tier over HTTP. The CVSS vector (PR:L/AC:L/UI:N) confirms that a standard authenticated account is sufficient - no administrative privileges, no special configuration, and no victim interaction are required. The vulnerable component (Cover Letter within Oracle Content Manager) must be enabled and accessible to the user's role. Exploitation is constrained to Oracle EBS deployments running Content Manager versions 12.2.3 through 12.2.15. Organizations where EBS is accessible only from trusted internal networks and where user accounts are tightly provisioned face meaningfully lower practical risk despite the low attack complexity.

The CVSS 3.1 base score of 6.3 (Medium) is appropriate given the network-accessible, low-complexity attack path requiring only a valid low-privileged account. The absence of privilege escalation (S:U) and the partial rather than complete CIA impact keep the score in the medium tier, but the PR:L/AC:L combination means any authenticated EBS user - not just administrators - could attempt exploitation. No EPSS score was provided in the source data, so exploitation probability cannot be quantified independently. The vulnerability has not been added to CISA's KEV catalog, and no public proof-of-concept exploit code has been identified, suggesting no known widespread active exploitation at time of analysis. Real-world risk is most significant for organizations where Oracle EBS is accessible to a large internal user base or where the application tier is internet-facing, as the low privilege requirement broadens the potential attacker pool. For organizations with tightly scoped EBS user roles and internal-only deployments, practical risk is lower despite the network attack vector.

An attacker with a standard low-privileged Oracle EBS user account sends crafted HTTP requests to the Cover Letter component of Oracle Content Manager, exploiting a likely authorization or input validation weakness to access or manipulate data beyond their permitted scope. The attacker could read restricted Content Manager records, modify or delete data entries, or trigger partial service degradation affecting other users of the component. No public proof-of-concept exploit code has been identified at time of analysis.