Oracle E-Business Suite CVE-2026-60677

Exploitation requires a valid low-privileged Oracle E-Business Suite account (CVSS PR:L - not unauthenticated) with network HTTP access to the Oracle Common Application Components / Common Modules interface, and it targets EBS versions 12.2.3 through 12.2.15. Exploitation is explicitly rated Difficult (CVSS AC:H), meaning success depends on additional conditions outside the attacker's direct control (such as specific timing, state, or configuration of the Common Modules component) rather than being reliably repeatable. No end-user interaction is needed (UI:N). Limiting factors that reduce real-world risk: authentication is mandatory, the high attack complexity impedes automation, and only versions in the 12.2.3-12.2.15 band are affected; the scope change (S:C) conversely increases risk by extending impact to additional Oracle products.

The CVSS 3.1 base score is 8.4 (High), driven largely by the scope change and full confidentiality/integrity impact, but the signals are mixed rather than uniformly severe. Attack complexity is High (AC:H), meaning exploitation depends on conditions the attacker cannot fully control, and Privileges Required is Low (PR:L), so a valid low-privileged EBS account is a prerequisite - this is not an unauthenticated internet-facing 'spray' bug. No EPSS score was provided, there is no public exploit identified at time of analysis, and the CVE is not in CISA KEV, so there is no evidence of active or imminent widespread exploitation. Net assessment: a genuine priority for organizations running affected EBS versions because EBS is a high-value ERP target and the scope change can cascade across modules, but the AC:H and PR:L requirements make mass automated exploitation unlikely, favoring targeted attacks by insiders or attackers who already hold a foothold. Note a data conflict to verify: the input Tags list 'Authentication Bypass' and 'Denial Of Service,' yet the CVSS vector specifies PR:L (authentication required) and only A:L (partial DoS) - treat the 'Authentication Bypass' tag as unverified against the vector.

An attacker who has obtained or been granted a low-privileged Oracle E-Business Suite account sends specially crafted HTTP requests to an Oracle Common Application Components endpoint, working around the high-complexity conditions to reach the flawed logic. On success they read or tamper with critical business data and, thanks to the scope change, pivot that impact into other EBS modules, potentially also degrading availability. No public proof-of-concept exists at time of analysis, so this remains a plausible but not turnkey attack.