Oracle E-Business Suite CVE-2026-60736

Exploitation requires network reachability to the Oracle E-Business Suite web tier over HTTP and, per the CVSS vector, a low-privileged authenticated account (PR:L) on the target Oracle E-Business Intelligence instance running an affected release (12.2.3-12.2.15); no user interaction is required (UI:N) and attack complexity is low (AC:L). The specific product feature at risk is the E-Business Intelligence 'Definition' component. Limiting factors: the attacker must already possess valid (if minimal) EBS credentials and must be able to reach the application over the network, so internet-exposed EBS portals are at materially higher risk than internally segmented ones. Note the input's 'Authentication Bypass' tag conflicts with PR:L - if the bypass claim holds, the authentication prerequisite may not apply; verify against the Oracle CPU July 2026 advisory before relying on the credential requirement as a mitigating control.

The CVSS 3.1 base score of 8.1 is driven by a fully remote HTTP vector (AV:N), low attack complexity (AC:L), no user interaction (UI:N), and High confidentiality and integrity impact, tempered only by the requirement for low privileges (PR:L) and no availability impact (A:N). This is a genuine priority for any organization running Oracle EBS 12.2.x, because most EBS deployments have many low-privilege authenticated users, making the PR:L barrier low in practice. However, real-world exploitation signals are limited: no EPSS score, no KEV listing, and no POC were provided, so there is no evidence of active or imminent mass exploitation - the risk is currently latent rather than demonstrated. One notable conflict: the 'Authentication Bypass' tag implies exploitation without credentials, yet the CVSS vector specifies PR:L (authenticated); this discrepancy should be verified against the Oracle advisory, as it materially changes who can exploit the flaw. Absent a POC and EPSS, prioritize based on exposure (internet-facing EBS instances) and the standard urgency of Oracle Critical Patch Update items.

A user holding a low-privilege Oracle EBS account (for example, an ordinary employee self-service login) sends crafted HTTP requests to the E-Business Intelligence Definition component and gains unauthorized read and write access to critical BI data or definitions beyond their assigned role. Because the CVSS vector shows AV:N/AC:L/PR:L/UI:N, no victim interaction and only low-tier credentials are needed, though no public POC has been identified at time of analysis.