Internet Procurement Connector CVE-2026-60759

The attacker must have network access to the Oracle Internet Procurement Connector instance via HTTP and must satisfy a high-complexity (AC:H) precondition - Oracle explicitly characterizes this as 'difficult to exploit,' indicating a specific application state, race condition, or protocol condition must be met rather than a trivial direct invocation of the bypass. No authentication or user interaction is required (PR:N/UI:N), so once the complexity barrier is cleared, no credentials are needed. The high attack complexity is the primary real-world limiting factor, reducing the realistic exploitation rate compared to low-complexity network vulnerabilities. Exploitation is constrained to deployments running E-Business Suite versions 12.2.3 through 12.2.15; patched instances and out-of-range versions are not affected. There is no availability impact and no scope change (S:U), meaning exploitation does not inherently pivot to adjacent systems.

The CVSS 3.1 score of 7.4 reflects a High-severity rating with significant confidentiality (C:H) and integrity (I:H) impacts and no availability impact (A:N). Network accessibility via HTTP (AV:N) with no privilege requirement (PR:N) and no user interaction (UI:N) broadens the attacker pool substantially - any host with HTTP reach to the connector is a potential source of exploitation. The critical moderating factor is High Attack Complexity (AC:H): Oracle explicitly describes this as 'difficult to exploit,' implying a race condition, specific application state, or protocol nuance must be satisfied before the bypass succeeds. No EPSS data was provided in the source intelligence, making probabilistic exploitation likelihood assessment unavailable. The vulnerability is absent from CISA KEV and no public exploit code has been identified at time of analysis, further supporting a lower immediate exploitation risk. Real-world prioritization should focus on internet-facing EBS deployments exposing the procurement connector externally, where determined threat actors may invest the effort to overcome the AC:H barrier given the high data-access payoff.

An unauthenticated remote attacker with HTTP access to a vulnerable E-Business Suite 12.2.x instance identifies and satisfies the high-complexity precondition - such as a specific timing window, application state, or protocol sequence - to bypass authentication in the Internal Operations component of Oracle Internet Procurement Connector. Once the bypass is achieved, the attacker reads all accessible procurement data (potentially including supplier contracts, purchase orders, and financial data) and can create, modify, or delete critical procurement records without valid credentials. No public exploit code has been identified at time of analysis.