Oracle Enterprise Asset Management CVE-2026-60760

Exploitation requires a valid, authenticated low-privilege account within Oracle E-Business Suite with at minimum some level of access to the EAM module. The attack is delivered over HTTP to the Internal Operations component, so network access to the EBS application server is necessary. High attack complexity (AC:H) means the attacker must satisfy additional conditions beyond simply being authenticated - the exact nature of these conditions (specific application state, parameter sequencing, timing) is not disclosed in available data. No user interaction from a victim is required (UI:N). Exploitation is limited by: the requirement for a pre-existing low-privilege EBS account, the high attack complexity which reduces reliability of exploitation, and the absence of availability impact which rules out denial-of-service abuse. Scope is unchanged (S:U), meaning compromise does not cascade beyond the EAM application boundary.

The CVSS 3.1 base score of 4.2 (Medium) is shaped primarily by AC:H (high attack complexity) and the limited C:L/I:L impact scope with no availability impact. The 'difficult to exploit' characterization from Oracle's own description aligns with AC:H, suggesting specific race conditions, sequencing requirements, or non-default state must be achieved even with a valid low-privilege session. The 'Authentication Bypass' tag elevates concern above what the numeric score implies, as authorization boundary failures in ERP systems can expose sensitive financial, operational, or asset data beyond what a low-privilege role should see. No EPSS score is provided - this is a notable gap in the risk picture. KEV status is negative and no public POC is known, which significantly reduces near-term exploitation probability. The combination of AC:H, PR:L, no POC, and no KEV places this in the category of a real but low-urgency risk: patch during the next scheduled maintenance window rather than emergency response. Organizations running internet-exposed EBS instances should treat this with higher urgency than those where EBS is internal-only.

An authenticated low-privilege EBS user - such as a general EAM viewer or data-entry clerk - crafts a specific sequence of HTTP requests targeting the Internal Operations component under conditions that satisfy the high-complexity exploitation requirement (e.g., a specific application state or parameter combination). By exploiting the authorization bypass, the attacker reads asset maintenance records or financial data outside their role scope, or submits unauthorized updates to work orders or asset records. No public POC exists, but the attack is feasible for a determined insider or a threat actor who has already compromised a low-privilege EBS account.