Oracle Enterprise Asset Management CVE-2026-60694

Exploitation requires the attacker to hold a valid low-privileged account with at least basic authenticated access to Oracle Enterprise Asset Management - unauthenticated exploitation is not supported by the CVSS PR:L metric. Additionally, a separate victim user (other than the attacker) must interact with the malicious content, meaning a higher-privileged user must open or render attacker-influenced data within the EAM Internal Operations component. This UI:R requirement means the attack cannot be fully automated and depends on social engineering or normal user workflow triggering the payload. The affected product must be running EBS version 12.2.3 through 12.2.15; earlier or later versions are not listed as affected. The scope change (S:C) implies the victim's broader EBS session context - not just EAM - can be impacted, but only if the victim holds cross-module privileges. Limiting factors: requires a valid account (no anonymous exploitation), requires victim interaction (not automatable end-to-end), and only affects EBS deployments in the listed version range.

The CVSS 3.1 base score of 5.4 (Medium) reflects a real but bounded risk profile: AV:N and AC:L confirm easy network exploitation once conditions are met, but PR:L (requires a valid low-privileged account) and UI:R (requires human interaction from a third party) meaningfully constrain exploitability. The scope change (S:C) elevates concern because successful exploitation can cascade to impact other E-Business Suite modules beyond EAM itself. No EPSS score was provided in the input data; this is therefore not assessable. No CISA KEV listing exists, and no public proof-of-concept has been identified, suggesting no confirmed mass exploitation as of the analysis date. The 'Authentication Bypass' tag in ENISA EUVD data introduces some ambiguity - if interpreted literally, it may suggest the low-privileged attacker can circumvent access controls rather than merely inject content, which would increase practical impact. However, the CVSS vector with PR:L and UI:R is more consistent with an injection/privilege amplification scenario than a direct unauthenticated bypass. CVSS and tag data are slightly in tension; defenders should consult Oracle's CPU advisory for component-level clarification. Overall: medium-priority patch for standard enterprise deployments; elevated priority for EBS instances accessible to untrusted low-privileged users or internet-exposed.

A low-privileged authenticated attacker with a standard EAM user account sends a crafted HTTP request to the Internal Operations component that embeds malicious content - for example, a stored XSS payload within an EAM work order or asset record. When a higher-privileged EAM user (such as a maintenance manager or administrator) later views that record, the payload executes in their browser session, potentially exfiltrating session tokens or performing unauthorized data modifications on their behalf across E-Business Suite modules. No public proof-of-concept exists at time of analysis.