Oracle E-Business Suite CVE-2026-60708

Exploitation requires network access to the Oracle E-Business Suite HTTP interface and a valid low-privileged account (CVSS PR:L), so this is authenticated abuse rather than unauthenticated compromise despite the vendor's 'Authentication Bypass' tag. The affected functionality is specifically the Internal Operations component of Oracle Process Manufacturing Financials in EBS 12.2.3 through 12.2.15; installations outside that version range or without the OPM Financials module deployed are not in scope. Limiting factors: the attacker must first obtain or possess EBS credentials, and exposure is far greater where the EBS web tier is reachable from broad or internet-facing networks; there is no availability impact (A:N), so the risk is unauthorized data disclosure and tampering, not service disruption.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) describes a genuinely attractive target profile: remotely reachable over HTTP, low attack complexity, no user interaction, and only low privileges required to achieve full read/write compromise of application data. Oracle explicitly labels it 'easily exploitable,' which reinforces the AC:L rating. However, the requirement for an authenticated account (PR:L) is the primary limiting factor and separates this from a fully unauthenticated internet-facing critical. No EPSS score, SSVC decision, POC, or KEV entry was provided in the input, so the probabilistic and real-world-exploitation signals are unavailable - this assessment rests on the CVSS vector and vendor description alone. Note a tension in the data: the vendor tag says 'Authentication Bypass,' yet the CVSS vector requires PR:L (a low-privileged account), so the flaw is better characterized as privilege/authorization escalation for an existing user than a true pre-auth bypass - verify with Oracle. Given Oracle EBS's history as an actively targeted enterprise ERP, an 8.1 authenticated data-compromise flaw should be treated as a high patching priority, especially where many users hold low-privilege EBS accounts.

An attacker who holds any low-privilege Oracle E-Business Suite account - for example a limited internal user or a compromised low-tier credential - sends crafted HTTP requests to the Process Manufacturing Financials Internal Operations functionality and reads or manipulates financial and manufacturing data beyond their authorized scope. Because attack complexity is low and no user interaction is needed, the action can be scripted once a foothold account exists; no public exploit code has been identified at time of analysis.