Oracle E-Business Suite CVE-2026-60676

Exploitation requires an authenticated session with a low-privileged Oracle E-Business Suite account (CVSS PR:L) and network HTTP access to the Oracle Applications Framework Search Bean component; the target must be running an affected EBS release in the 12.2.3-12.2.15 range. No user interaction is required (UI:N) and attack complexity is low (AC:L), and Oracle labels it 'easily exploitable.' Limiting factors that reduce real-world risk: the attacker cannot be fully anonymous - valid credentials (however low-tier) are needed - and the Search Bean endpoint must be reachable, so EBS instances with the self-service tier restricted to internal networks or VPN present a materially smaller attack surface than internet-exposed deployments.

Signals are largely consistent and point to a genuine priority. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with unchanged scope but full C/I/A impact - a base score of 8.8 (High). Oracle explicitly characterizes it as 'easily exploitable,' reinforcing the AC:L rating. That said, PR:L means the attacker must already hold a valid (even if unprivileged) EBS account, which meaningfully constrains purely anonymous internet-wide attack compared to a PR:N flaw. No EPSS score, SSVC decision, KEV listing, or POC was provided, so exploitation probability cannot be quantified and there is no evidence of active exploitation. The main residual risk driver is EBS's frequent internet exposure via self-service portals: an attacker with any low-tier account (or one obtained via phishing/credential stuffing) could pivot to full component takeover. Net: treat as high priority for internet-facing EBS, but note the absence of EPSS/KEV/POC data means real-world exploitation likelihood is currently unknown rather than confirmed.

An attacker who holds or acquires any low-privileged Oracle E-Business Suite self-service account (for example through credential stuffing or phishing) sends crafted HTTP requests to the Search Bean functionality of Oracle Applications Framework. Because the flaw is network-accessible, low-complexity, and needs no user interaction, the attacker leverages it to compromise and take over the Applications Framework, gaining high impact on confidentiality, integrity, and availability. No public proof-of-concept was identified at time of analysis.