Oracle E-Business Suite CVE-2026-60678

Exploitation requires network access to the Oracle E-Business Suite SOAP web-service interface exposing the Oracle General Ledger Internal Operations component, plus a valid low-privileged EBS account (CVSS PR:L confirms authentication is required - this is not unauthenticated). The specific channel is SOAP, so the SOAP/web-services layer of EBS must be reachable by the attacker. Limiting factors: the requirement for pre-existing low-privileged authenticated access narrows the attacker population, and only supported versions 12.2.3 through 12.2.15 are stated as affected; no special non-default configuration is called out by Oracle, and no user interaction is needed (UI:N), so any authenticated user able to reach the SOAP endpoint is a candidate.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) signals a genuinely high-priority issue: network-reachable, low attack complexity, no user interaction, and full CIA impact, requiring only low privileges. Oracle's own wording - 'easily exploitable' and 'takeover' - reinforces the severity. However, the mitigating signal is PR:L: the attacker must already hold some authenticated, low-privileged access to the EBS environment, which limits fully anonymous internet exploitation. No EPSS score, KEV listing, or POC was provided, so real-world exploitation probability cannot be quantified from the input; the absence of KEV and POC data means this should be treated as a serious patch-priority item based on severity and product criticality rather than as confirmed active exploitation. Financial ERP modules like General Ledger are high-value targets, which raises practical risk despite the missing exploitation telemetry.

An attacker who has obtained a low-privileged Oracle E-Business Suite account (via phishing, credential reuse, or an insider) sends a crafted SOAP request to the General Ledger Internal Operations endpoint. Because the attack is network-based with low complexity and no user interaction, the request results in full compromise (takeover) of the General Ledger component, allowing the attacker to read, alter, or destroy financial ledger data. No public POC was identified at time of analysis.