Oracle EDI Gateway CVE-2026-60756

Exploitation targets the Oracle EDI Gateway component of Oracle E-Business Suite 12.2.3-12.2.15 and requires only network reachability to the EBS HTTP web tier - no authentication (PR:N) and no user interaction (UI:N) per the CVSS vector. The primary limiting factor is the High attack complexity (AC:H): Oracle explicitly describes it as 'difficult to exploit,' meaning success depends on conditions outside the attacker's direct control (such as a specific environmental state, race, or non-trivial precondition) rather than a single deterministic request. Realistic exposure is further limited to deployments where the EBS application tier and EDI Gateway endpoints are network-reachable by the attacker; installations restricted to internal networks or fronted by access controls substantially reduce the practical attack surface.

Signals partially conflict and warrant careful prioritization. The CVSS 3.1 base score of 8.1 is High and reflects an unauthenticated network vector (AV:N/PR:N/UI:N) with total CIA impact (C:H/I:H/A:H) - a serious combination. However, Oracle itself marks the attack complexity as High (AC:H) and the description states it is 'difficult to exploit,' which meaningfully lowers real-world exploitability relative to a straightforward AC:L flaw. No EPSS score, POC, or KEV status was provided in the input; this CVE is therefore 'no public exploit identified at time of analysis,' and there is no evidence of active exploitation. There is also a data conflict worth flagging: the vendor tag says 'Information Disclosure' while the description asserts full takeover with I:H and A:H - the description and CVSS vector should be treated as authoritative over the tag. Net assessment: a genuine High-severity issue on internet-adjacent ERP infrastructure that merits prompt patching, but the AC:H barrier suggests targeted rather than mass, automated exploitation.

An attacker with network access to an exposed Oracle E-Business Suite web tier sends crafted HTTP requests to the EDI Gateway component, exploiting the flaw without any credentials or user interaction. Because attack complexity is High, the attacker likely needs to satisfy specific timing, configuration, or environmental conditions before the request succeeds, after which they gain full control of the EDI Gateway and its data. No public proof-of-concept was identified at time of analysis.