Oracle Assets CVE-2026-60755

Exploitation requires the attacker to already hold high application privileges within Oracle E-Business Suite (CVSS PR:H) and network HTTP access to the Oracle Assets Internal Operations component; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The limiting factors are significant: the attacker must be an authenticated, high-privilege EBS user, so this is not exploitable by anonymous or low-privilege remote actors, and only EBS deployments running Oracle Assets versions 12.2.3 through 12.2.15 are affected. Realistic risk therefore centers on privileged insiders or adversaries who have already escalated to a privileged EBS account.

The signals point to a real but conditionally-gated risk rather than a mass-exploitation emergency. The CVSS vector (AV:N/AC:L/PR:H/UI:N) shows network reachability with low attack complexity and no user interaction, but PR:H is the dominant limiting factor - the attacker must already hold high application privileges, which sharply narrows the realistic threat to malicious insiders or attackers who have already compromised a privileged EBS account. Full C:H/I:H/A:H impact (application takeover) justifies the 7.2 High rating. No EPSS score, KEV listing, or public POC is present in the input, so there is no evidence of active or imminent exploitation; the absence of EPSS/POC data means widespread automated attack probability cannot be quantified. This is a patch-in-your-normal-CPU-cycle priority for most, but should be escalated where EBS is internet-exposed or where privileged-account hygiene is weak.

An attacker who has obtained a high-privilege Oracle Assets account - for example a rogue finance administrator or an outsider who has phished privileged EBS credentials - sends crafted HTTP requests to the Internal Operations component and abuses the flaw to fully compromise the Assets module, reading and altering fixed-asset financial records. Because no user interaction is required and attack complexity is low, the action is straightforward once the privileged session exists. No public exploit code is identified at time of analysis.