Oracle E-Business Suite CVE-2026-60692

Exploitation requires network access to the Oracle E-Business Suite HTTP web tier and a valid low-privileged application account (PR:L) - it is authenticated, not fully anonymous - targeting the Enterprise Asset Management module's Internal Operations component on versions 12.2.3-12.2.15. No user interaction is required (UI:N) and attack complexity is low (AC:L), so a single logged-in user can trigger it directly. Limiting factors that reduce real-world risk: the attacker must first obtain application credentials, the EBS instance must be network-reachable to the attacker, and only the 12.2.3-12.2.15 code line is in scope; instances not exposing eAM or restricted to trusted networks are correspondingly harder to reach.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) points to a genuinely serious, easily exploitable flaw: network-reachable over HTTP, low attack complexity, no user interaction, and only a single low-privileged account required - a realistic bar in multi-user ERP environments where many employees hold application logins. Impact is total (High across C/I/A) with 'takeover' explicitly stated by Oracle. Countering signals: no EPSS score was supplied, no proof-of-concept is referenced, and the CVE is not in CISA KEV, so there is no evidence of active or widespread exploitation yet. SSVC-style reasoning: exploitation status is currently 'none/POC-absent', technical impact is 'total', and automatability is uncertain (authentication is required, which usually limits mass automation). Net: this is a high-priority patch for any organization running EBS eAM because the prerequisites are low and impact is complete, but the absence of KEV/EPSS/POC data means urgency should be driven by exposure of the EBS instance rather than by confirmed in-the-wild attacks.

An attacker who holds any low-privileged Oracle E-Business Suite application account (or phishes/purchases one) sends crafted HTTP requests to the eAM Internal Operations functionality and, because attack complexity is low and no user interaction is needed, escalates to full takeover of the Enterprise Asset Management module - reading, altering, or destroying its data. No public proof-of-concept is identified at time of analysis, so exploitation currently requires the attacker to independently develop the technique.