Oracle E-Business Suite CVE-2026-60686

Exploitation requires the target to be running the Oracle U.S. Federal Financials module of Oracle E-Business Suite 12.2.3-12.2.15 with the Internal Operations component accessible over HTTP, and the attacker must possess a valid low-privileged EBS account (PR:L) with network reachability to the application web tier. What limits exploitation: it is NOT unauthenticated - an authenticated foothold is mandatory (per CVSS PR:L), and only deployments that have the U.S. Federal Financials product installed and licensed are exposed, which is a narrow, primarily U.S. federal-government population rather than the general EBS install base. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once those preconditions are met exploitation is easy. Availability is not impacted, so this cannot be used for denial of service.

The signals are moderately concerning but not top-tier emergency. CVSS is 8.1 High, driven by network vector (AV:N), low attack complexity (AC:L), no user interaction (UI:N), and high confidentiality and integrity impact - but it requires low privileges (PR:L), meaning the attacker must already hold a valid EBS account, which meaningfully narrows the exposed population to authenticated (often internal or federated) users. Availability is unaffected (A:N), so this is a data-exposure and data-tampering risk rather than a service-outage risk. No EPSS score, KEV entry, or SSVC decision data was provided, and no public POC was identified, so exploitation probability cannot be quantified from the input; the vendor's own 'Authentication Bypass' tag is the strongest amplifier, suggesting the PR:L barrier may be weaker in practice than the vector implies. Net: for federal agencies actually running the U.S. Federal Financials module this is a real high-priority patch (sensitive government financial data, integrity impact); for organizations not running that specific module the practical exposure is low. No conflicting data, but the absence of EPSS/KEV/POC signals means real-world exploitation likelihood is currently unknown rather than confirmed low.

An attacker who holds any low-privilege Oracle EBS account - for example a limited internal user, a compromised employee credential, or a federated partner login - sends crafted HTTP requests to the U.S. Federal Financials Internal Operations component and, by bypassing intended authorization, reads or alters sensitive federal financial records they should not be able to touch. Because attack complexity is low and no user interaction is needed, exploitation is straightforward once a foothold account exists; no public POC has been identified at time of analysis.