Oracle E-Business Suite CVE-2026-60681

Exploitation requires network HTTP access to an Oracle EBS instance running the Process Manufacturing Regulatory Management component at version 12.2.3-12.2.15, plus a low-privileged authenticated EBS account (CVSS PR:L) - it is not fully unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the target must have the OPM Regulatory Management module deployed and reachable by the attacker, and the attacker must possess valid low-level EBS credentials; deployments that keep the EBS web tier off the public internet and enforce DMZ URL allowlisting substantially narrow the reachable attack surface.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with full impact to the target component - Oracle explicitly calls it 'easily exploitable.' This makes it a genuine priority for internet-exposed or broadly-accessible EBS deployments. However, no EPSS score, POC, or KEV listing was provided, so there is currently no evidence of active exploitation or public exploit code; the signals available (vendor CVSS, low PR/AC) indicate high exploitability potential rather than demonstrated in-the-wild use. One tension to verify: the 'Information Disclosure' tag understates a vector that Oracle describes as full 'takeover' with high integrity and availability impact - treat this as a full-compromise issue, not merely info-leak, and confirm details against the Oracle CPU advisory.

An attacker who holds any low-privileged EBS application account (or phishes/obtains one) sends crafted HTTP requests to the OPM Regulatory Management endpoints, exploiting the flaw without any user interaction to escalate to full control of the module. Because attack complexity is low and no elevated privileges are needed, the attacker can then read, alter, or destroy regulatory/compliance data. No public POC is currently identified, so an attacker would need to develop the exploit or await public disclosure.