Oracle E-Business Suite CVE-2026-60706

Exploitation requires network HTTP access to an Oracle E-Business Suite deployment running the Oracle Process Manufacturing Inventory module (Internal Operations component) at version 12.2.3-12.2.15, plus a valid low-privileged EBS account (CVSS PR:L). No user interaction, no elevated/admin privileges, and no non-default configuration are needed beyond having OPM Inventory deployed and reachable. Limiting factors: the attacker must already authenticate to EBS, so an unauthenticated outside attacker cannot exploit it directly, and only environments that actually license and run the OPM Inventory module are exposed - despite the 'Authentication Bypass' tag, Oracle's vector confirms authentication (a low-priv account) is required.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) describes an easily exploitable, network-reachable issue needing only low privileges and no user interaction, yielding high confidentiality and integrity impact - a genuinely serious authorization flaw once an attacker holds any valid EBS account. Countervailing signals lower the urgency: no EPSS score is provided, the CVE is not in CISA KEV, and no public POC or exploit code is identified, so this is not confirmed as actively exploited. Note a conflict in the source data: the intelligence tag reads 'Authentication Bypass,' which would normally imply PR:N, yet Oracle's authoritative CVSS vector specifies PR:L (a valid low-privileged account is required) - treat the tag as a loose label and the PR:L vector as authoritative unless Oracle states otherwise. Overall this is a real prioritization target for EBS operators (broad data read/modify, low complexity) but the practical risk hinges on having a foothold account, and absence of exploitation evidence argues for prompt-but-not-emergency patching.

An attacker who has obtained any low-privilege Oracle EBS account (for example a limited internal user, contractor, or a compromised employee credential) sends crafted HTTP requests to the OPM Inventory Internal Operations endpoints and, exploiting the access-control weakness, reads and alters inventory-critical data across the module beyond their authorized scope. No user interaction or elevated privileges are required and attack complexity is low; no public POC is currently available.