Oracle E-Business Suite CVE-2026-60670

Exploitation targets the Client System Analyzer component of the Oracle Applications Technology Stack in Oracle E-Business Suite 12.2.3-12.2.15 and is performed remotely over HTTP with no authentication (PR:N) and no user interaction (UI:N) required. What limits exploitation is the high attack complexity (AC:H): Oracle explicitly rates the flaw 'difficult to exploit,' meaning the attacker must satisfy a condition outside their control - such as a specific server state, race, or configuration - and cannot exploit it reliably on demand. Practical exposure also requires that the E-Business Suite instance and its Client System Analyzer HTTP endpoint be network-reachable by the attacker; instances behind segmentation or without the CSA endpoint exposed present a materially smaller attack surface.

The signals are mixed and should be weighed rather than taken from the 8.1 headline alone. The CVSS vector (AV:N/AC:H/PR:N/UI:N) means the flaw is network-reachable and requires no authentication or user interaction, but AC:H indicates a meaningful hurdle - a special condition, race, or non-trivial setup must be met, which real-world attackers do not always overcome reliably. Impact is maximal (C:H/I:H/A:H, unscoped) and Oracle explicitly describes 'takeover.' There is no EPSS score, no KEV listing, and no known POC in the provided data, so there is no evidence of active or imminent exploitation. Net: this is a genuinely high-severity, unauthenticated internet/network-facing flaw in a high-value ERP system and should be prioritized for patching, but the high attack complexity and absence of exploitation signals argue against emergency treatment relative to an AC:L KEV-listed bug. EPSS and CWE data are missing - treat exploitability estimates as uncertain until Oracle or third parties publish more detail.

An attacker with network access to the E-Business Suite front end sends crafted HTTP requests to the Client System Analyzer endpoint, satisfying the specific timing or input conditions that make the flaw exploitable, and leverages the resulting flaw to gain control of the Applications Technology Stack. Because no authentication or user interaction is required, an internet-exposed EBS instance could be attacked directly, though the high attack complexity means reliable exploitation is not trivial. No public exploit code is identified at time of analysis.