Oracle General Ledger CVE-2026-60693

Exploitation requires a valid low-privileged account on the Oracle E-Business Suite instance (CVSS PR:L confirmed), meaning unauthenticated remote exploitation is not possible - the attacker must first obtain or compromise an EBS credential. Network access via HTTP to the EBS application tier is required (CVSS AV:N). High attack complexity (CVSS AC:H) means a specific exploitation condition must be met beyond simply sending a request - this likely involves a particular request sequence, timing condition, or internal state; Oracle describes this as 'difficult to exploit.' The 'Authentication Bypass' tag indicates that the vulnerability's impact exceeds what the PR:L privilege level normally permits, suggesting an authorization flaw in the Internal Operations component allows privilege escalation within the application context. Exploitation is limited to GL versions 12.2.3-12.2.15; the specific network configuration or EBS module enablement requirements are not detailed in available data.

The CVSS 3.1 score of 7.1 reflects genuine severity on a financial system: C:H and I:H mean an attacker can fully read and tamper with General Ledger data - a catastrophic outcome for financial integrity and audit compliance. However, two metrics moderate real-world exploitability: PR:L requires the attacker to hold a valid (even minimal) EBS account, and AC:H indicates exploitation is not trivial and requires a specific exploitation condition to be met. The 'Authentication Bypass' tag is the most alarming signal here - it implies that the PR:L account may be sufficient to bypass authorization to high-privilege internal functions, which elevates urgency beyond what raw CVSS complexity suggests. No EPSS data was provided; with no KEV listing and no public POC, this is a vendor-disclosed-only vulnerability at time of analysis. Real-world risk is highest for organizations exposing EBS HTTP interfaces beyond a trusted network perimeter, and for those with large numbers of low-privilege EBS user accounts (e.g., end-users or integrations). A:L (partial DoS) is a secondary concern relative to the data integrity risk.

An attacker with a valid low-privilege Oracle E-Business Suite account - such as a standard finance end-user or a compromised integration service account - sends a crafted HTTP request to the Internal Operations component of Oracle General Ledger. By satisfying the high-complexity exploitation condition (for example, a specific request sequence or timing requirement), the attacker bypasses authorization controls and gains the ability to read all GL data, modify or delete journal entries and ledger balances, or cause partial service disruption to GL processing. No public proof-of-concept code has been identified at time of analysis.