Oracle Applications DBA CVE-2026-60761

The attacker must have an active local logon to the operating system or application infrastructure where Oracle Applications DBA executes (AV:L) - remote unauthenticated exploitation is not possible. A low-privileged account (PR:L) is sufficient; no administrative or DBA-level credentials are required to initiate the attack. The vulnerability is in the Internal Operations subcomponent of Oracle Applications DBA within E-Business Suite versions 12.2.3 through 12.2.15 - versions outside this range are not confirmed affected. The 'Authentication Bypass' tag suggests that while PR:L is the baseline requirement, the flaw may allow that low-privileged user to circumvent internal authorization controls that would otherwise restrict access to sensitive DBA operations or data. No user interaction is required (UI:N) and no special non-default configuration is stated as a prerequisite - any standard deployment of the affected EBS versions on a host accessible to low-privileged users is potentially exposed. Limiting factors: exploitation is constrained to actors with local system access; no integrity or availability impact limits the damage to data confidentiality only.

The NVD CVSS 3.1 base score of 6.5 (Medium) is technically accurate but may understate operational risk in EBS environments. The AV:L vector limits exposure to actors with local infrastructure access - reducing internet-facing attack surface - yet in large enterprises Oracle EBS application servers are frequently accessed by a broad pool of users, DBAs, and service accounts, widening the realistic attacker pool. The AC:L and UI:N combination, combined with Oracle's own 'easily exploitable' classification, means no exploit sophistication is required once local access is established. The S:C (Scope Changed) metric and C:H (High Confidentiality) rating are the most operationally significant signals: data exfiltration can extend beyond the Oracle Applications DBA process itself to other Oracle EBS subsystems, potentially exposing financial records, HR data, or application credentials depending on what the DBA component can access. No EPSS score was provided in the source data, and no KEV listing exists, so exploitation probability from threat intelligence signals is unconfirmed. The 'Authentication Bypass' tag implies that even the low-privilege prerequisite (PR:L) may be further weakened - a low-privileged user may be able to bypass internal authentication controls to impersonate higher-privileged DBA operations. The absence of a CWE classification and limited reference detail reduce analytical confidence. This is a medium-severity finding that should be prioritized in EBS environments with multi-tenant or broad internal user access.

An attacker with a low-privileged OS or application account on the Oracle E-Business Suite infrastructure host - such as a developer, junior DBA, or compromised service account - triggers the authentication bypass flaw within the Internal Operations component of Oracle Applications DBA. Without requiring any elevated credentials or user interaction, the attacker reads critical data accessible to the DBA component, potentially including database credentials, application configurations, or business data, and the scope change allows this access to cascade into co-located Oracle EBS subsystems. No public proof-of-concept code has been identified, but Oracle's own 'easily exploitable' classification suggests the attack path does not require advanced tooling.