Oracle E-Business Suite CVE-2026-60675

Exploitation requires network HTTP access to an Oracle E-Business Suite 12.2.3-12.2.15 instance whose Oracle Applications Framework Search Bean is reachable, plus a valid low-privileged EBS account (CVSS PR:L - this is an authenticated attack, not anonymous). No user interaction is needed (UI:N) and complexity is low (AC:L), so any user who can reach the search/query functionality can attempt it. The practical limiting factors are: the attacker must first hold at least one low-privilege credential; the target must run an affected 12.2.x release; and the OAF Search Bean endpoint must be network-reachable - organizations that keep EBS behind a VPN/allowlist and tightly control low-privilege account issuance materially raise the bar despite the high CVSS score.

The signals that are present align on elevated risk: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity attack needing only low privileges and no user interaction, with high impact to all three security properties - Oracle's 'easily exploitable' language reinforces the AC:L rating. However, key corroborating signals are missing: no EPSS probability was provided, there is no KEV listing (not confirmed actively exploited), and no POC has surfaced, so exploitation is currently theoretical rather than demonstrated. The PR:L requirement is a meaningful limiter - an attacker still needs a valid, if low-privileged, EBS account - which distinguishes this from a fully unauthenticated internet-facing flaw. Net assessment: a genuine high-priority patch item for organizations running internet-exposed EBS 12.2.x (self-service portals frequently host many low-privilege users), but not an emergency zero-day; the 8.8 is driven by impact and ease, tempered by the authentication prerequisite and the absence of exploitation evidence.

An attacker who has obtained or been granted a low-privilege Oracle E-Business Suite account (for example a self-service or vendor-portal login) sends crafted HTTP requests to an OAF Search Bean endpoint, manipulating search parameters to escape the intended query scope. With no user interaction and low attack complexity, the attacker escalates from restricted search access to full control of the Oracle Applications Framework, reading or altering ERP data and disrupting availability. No public proof-of-concept is currently identified, so this scenario is inferred from the CVSS vector and Oracle's 'takeover' description.