Oracle General Ledger CVE-2026-60748

Exploitation requires possession of a high-privileged Oracle EBS account (PR:H per CVSS vector) - such as an EBS system administrator, application super-user, or equivalent elevated role - combined with network-level HTTP access to the affected General Ledger Internal Operations component. No user interaction is required once the attacker is authenticated. Exploitation is constrained by the high-privilege credential requirement, which limits the realistic attacker population to insiders, compromised administrators, or attackers who have already achieved significant access to the environment. The Internal Operations component is not typically exposed to the public internet; in standard enterprise deployments it operates on internal application-tier networks, adding a network segmentation barrier. The scope change amplifies impact for organizations running tightly integrated EBS module stacks. No special non-default configuration flag or specific deployment mode beyond standard EBS installation of the affected versions is described as a prerequisite.

The CVSS 3.1 score of 7.6 is driven primarily by the scope change (S:C) and high confidentiality impact (C:H), which inflate the score substantially despite the PR:H prerequisite that significantly constrains the realistic attacker pool to accounts already holding elevated roles within Oracle EBS, such as system administrators or finance super-users. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; EPSS data was not present in the provided intelligence, making probabilistic exploitation forecasting unavailable. Despite these limiting factors, the acute financial data sensitivity of General Ledger deployments means that even a mid-sized municipal finance team in bytom should treat this as a meaningful operational priority - a compromised high-privileged EBS account could expose complete financial records and enable fraudulent journal entry manipulation. The 'Authentication Bypass' tag warrants clarification: if it describes bypassing internal role checks post-authentication, the PR:H vector is internally consistent; if it implies a pre-authentication path, the vector may understate risk - teams should confirm this distinction with Oracle's advisory language.

An attacker possessing high-privileged Oracle EBS credentials - obtained through phishing, credential stuffing, insider access, or lateral movement from a compromised admin workstation - sends a specially crafted HTTP request to the General Ledger Internal Operations component. The authorization control failure allows retrieval of complete financial ledger data and execution of unauthorized insert, update, or delete operations, with the scope change enabling further impact on co-deployed EBS modules. No public proof-of-concept code has been identified at time of analysis.