Oracle E-Business Suite CVE-2026-60683

Exploitation requires the target to be running Oracle E-Business Suite 12.2.3-12.2.15 with the Oracle Process Manufacturing (OPM) Regulatory Management product and its Internal Operations component deployed and reachable over HTTP. Per the CVSS vector (PR:L), the attacker must be authenticated with a low-privileged EBS account; no user interaction is needed and attack complexity is low. Limiting factors: the specific OPM Regulatory Management module must actually be installed and licensed (it is not part of every EBS deployment), and the attacker needs some valid low-privilege credential or session, so this is not a fully unauthenticated internet-facing bug despite the network vector.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7 High) indicates easy remote exploitation over HTTP requiring only low privileges and no user interaction, with a scope change that magnifies impact to other products - a meaningful signal for a confidentiality-only bug. Impact is limited strictly to confidentiality (I:N/A:N), so this is a data-exposure risk, not code execution or service disruption. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so real-world exploitation likelihood cannot be quantified; the absence of KEV means no confirmed active exploitation. This is a genuine priority for organizations running EBS with the OPM Regulatory Management module because it is Oracle-Critical-Patch-Update material with low attack complexity and only requires a foothold account, but for environments not deploying OPM the practical exposure is lower.

An attacker who holds a low-privileged EBS account (or obtains one via phishing or a weak self-service registration) sends crafted HTTP requests to the OPM Regulatory Management Internal Operations endpoints and, exploiting the authentication/authorization weakness, retrieves critical data they are not authorized to see. Because of the scope change, the disclosed data may include information belonging to other integrated Oracle products. No public proof-of-concept was identified at time of analysis.