Oracle E-Business Suite CVE-2026-60764

Exploitation requires (1) network HTTP access to the Oracle E-Business Suite web tier hosting the Financials Common Modules component, and (2) a valid low-privileged EBS application account (CVSS PR:L - not fully unauthenticated despite the 'Authentication Bypass' tag). No user interaction and no non-default configuration are stated as required, and attack complexity is low (AC:L), so any low-privilege user reaching the affected component can attempt it. Limiting factors: the attacker must already authenticate to EBS at some privilege level, the affected versions are specifically 12.2.3 through 12.2.15, and impact is confined to data confidentiality and integrity (A:N) within Financials Common Modules accessible data. Exposure is substantially reduced where the EBS web tier is not internet-facing and low-privilege accounts are tightly controlled.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) describes a network-reachable, low-complexity attack needing only low privileges and no user interaction, yielding high confidentiality and integrity impact but no availability impact - a realistic prioritization concern for internet- or intranet-exposed EBS deployments. However, several signals are missing: no EPSS score, no SSVC decision, and no CWE were provided, so exploitation probability cannot be quantified from the input. There is no public exploit identified and the CVE is not in CISA KEV, so this is not confirmed active exploitation. The main risk driver is the low bar (any authenticated low-privilege EBS user) against a widely deployed enterprise ERP; the main mitigant is that PR:L means the attacker must already possess valid application credentials, and A:N means no denial-of-service. Note the tension between the 'Authentication Bypass' tag and PR:L in the CVSS vector - the vector requires some authentication, so treat 'authentication bypass' as likely referring to authorization/privilege bypass rather than fully unauthenticated access; verify with Oracle's advisory.

An attacker who has obtained or was granted a low-privileged Oracle E-Business Suite application account sends crafted HTTP requests to the Financials Common Modules Common Components endpoints and, exploiting the authorization weakness, reads or alters financial data far beyond their intended permissions. Given AC:L and no required user interaction, the requests are straightforward to construct once access to the EBS web tier exists; no public proof-of-concept has been identified at time of analysis.