Oracle Interaction Blending CVE-2026-60703

Exploitation requires local logon access (AV:L) to the infrastructure where Oracle Interaction Blending executes plus a low-privileged account on that system (PR:L) - a valid but unprivileged foothold, not remote unauthenticated access. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once an attacker has any low-level access the attack is straightforward. Limiting factors: the local vector rules out direct internet exploitation, the attacker must already be authenticated at a low privilege level, and only Oracle E-Business Suite deployments actually running the Interaction Blending module (releases 12.2.3-12.2.15) are affected. The vendor 'Authentication Bypass' tag conflicts with the PR:L requirement and should be verified with Oracle.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) describes a locally exploitable issue with low attack complexity requiring pre-existing low-level access and no user interaction, yielding high confidentiality and integrity impact but no availability impact - a real but bounded 7.1/High. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input; the absence of KEV and POC signals means this is not confirmed to be under active or automated exploitation. The local attack vector (AV:L) meaningfully constrains real-world risk: the attacker must already have interactive logon to the infrastructure running the module, making this an insider or post-foothold data-access escalation rather than an internet-facing mass-exploitation target. One conflict to verify: the vendor tag says 'Authentication Bypass' yet CVSS specifies PR:L (privileges required) - confirm with Oracle whether prior authentication is genuinely needed.

An attacker who has already obtained a low-privileged interactive account on the server hosting Oracle Interaction Blending logs in locally and, without any user interaction, abuses the vulnerable Internal Operations component to read sensitive contact-center data and to create, alter, or delete records across all data the module can access. Because attack complexity is low, exploitation is reliable once the foothold exists, but no public exploit code has been identified at time of analysis.