Oracle CMRO CVE-2026-60717

Requires a valid, authenticated low-privileged account within Oracle E-Business Suite with network-level HTTP access to the CMRO application. The vulnerable component is Common Utilities within the CMRO module. No non-default configuration or special feature enablement is described as a prerequisite - any CMRO deployment within the version range 12.2.3 to 12.2.15 with a reachable HTTP interface is potentially affected. Exploitation is bounded by the requirement for prior authenticated access: unauthenticated external attackers cannot directly exploit this flaw. Defenders limiting internet exposure of EBS HTTP interfaces, enforcing strong account provisioning controls, and applying least-privilege role assignments for CMRO users meaningfully reduce practical exploitation risk beyond what the raw CVSS score reflects.

The CVSS 3.1 base score of 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N reflects a network-exploitable flaw with no attack complexity barriers and no user interaction required, tempered by the need for a low-privileged authenticated account. The combination of low complexity and no UI interaction lowers the operational barrier for exploitation once an account is obtained. No EPSS score was present in the source data, so quantitative exploitation probability cannot be stated. The vulnerability is not listed in CISA KEV and no public proof-of-concept code has been identified, suggesting it has not attracted mass exploitation at time of analysis. A meaningful tension exists between the 'Authentication Bypass' tag and the PR:L CVSS metric: a true authentication bypass would typically yield PR:N, so this likely represents an authorization bypass (privilege escalation within an authenticated session) rather than full unauthenticated access. Real-world risk is moderate for organizations running CMRO: an insider or compromised low-privilege EBS account could tamper with maintenance records or exfiltrate sensitive operational data, which in defense and aviation contexts can carry regulatory and safety implications beyond typical data integrity concerns.

An attacker holding a standard low-privileged Oracle EBS or CMRO user account - such as a line technician, contractor, or compromised service account - sends crafted HTTP requests to the CMRO Common Utilities endpoint, bypassing authorization checks to read maintenance records or insert and modify data outside their sanctioned access. No public exploit code exists at time of analysis, but the low attack complexity means exploitation requires no special tooling beyond standard HTTP interaction with the application.