Oracle Order Management CVE-2026-60746

Exploitation requires (1) a valid authenticated account with at least low privileges on the target Oracle Order Management instance (PR:L - not a pre-auth or anonymous flaw), (2) network HTTP access to the Product Diagnostic Tools component of Oracle Order Management, and (3) an affected version in the 12.2.3-12.2.15 range of Oracle E-Business Suite. The attack is explicitly high-complexity (AC:H), meaning success depends on conditions outside the attacker's direct control (e.g., specific state, timing, or configuration), which limits reliable/repeatable exploitation. No user interaction is required (UI:N). The key limiting factors defenders can rely on are the mandatory authenticated low-privilege foothold and the high attack complexity.

This is a moderate-severity (CVSS 3.1 5.9) authenticated vulnerability in the Product Diagnostic Tools component of Oracle Order Management within Oracle E-Business Suite. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N) tells a consistent story with the description: network-reachable over HTTP, but exploitation is explicitly rated high-complexity (AC:H) and requires an authenticated low-privileged account (PR:L). The impact is weighted toward confidentiality (C:H - potentially complete read access to all Order Management data) with only limited integrity impact (I:L) and no availability impact (A:N). No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so exploitation-probability signals are entirely absent - there is no evidence of active exploitation or public exploit code. In practical terms this is NOT a drop-everything emergency on the level of an unauthenticated RCE: the combination of required valid credentials and genuinely high attack complexity meaningfully raises the bar. However, Oracle E-Business Suite is a high-value target holding sensitive business/financial data, and the confidentiality impact is severe, so it warrants prompt patching in the normal Oracle Critical Patch Update cycle. One conflict to flag: the input Tags include 'Authentication Bypass,' but the CVSS vector specifies PR:L (a privileged attacker) and the description describes a 'low privileged attacker,' which directly contradicts an authentication-bypass characterization - verify the vulnerability class with Oracle's advisory.

An attacker who already holds a low-privileged Oracle Order Management account sends crafted HTTP requests to the Product Diagnostic Tools component, exploiting the flaw to read sensitive order and customer data outside their authorization scope and to make limited unauthorized data modifications. The high attack complexity (AC:H) means success likely depends on specific timing, state, or non-trivial preconditions rather than a single trivial request. No public exploit code or active exploitation has been identified for this CVE at time of analysis.