Oracle Applications Framework CVE-2026-60768

Exploitation requires an authenticated, low-privileged session to Oracle E-Business Suite (CVSS PR:L) with HTTP/HTTPS reachability to the Oracle Applications Framework self-service tier, specifically the Graph / Charting component of a 12.2.3-12.2.15 deployment. No user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors that reduce real-world risk: the attacker must possess valid EBS credentials or a foothold account, and the EBS web tier must be network-accessible to that attacker - internet-exposed EBS instances face materially higher exposure than those confined to internal/VPN networks. Note the unresolved tension between the vendor 'Authentication Bypass' tag and the PR:L rating; verify with Oracle whether an unauthenticated path exists.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1) indicates a genuinely serious, low-friction issue: network-reachable over HTTP, low attack complexity, no user interaction, and only low privileges required - meaning any authenticated EBS user (potentially a large, semi-trusted population in ERP deployments) can achieve full read/write compromise of framework-accessible data. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation-in-the-wild cannot be asserted; the risk case rests on the CVSS profile plus the high value of EBS data (financials, HR, procurement). One caveat: the PR:L rating requires authentication, yet the vendor tag reads 'Authentication Bypass' - these signals are in mild tension, so defenders should verify with Oracle whether a low-privileged account is truly required or whether an auth-bypass path exists. Overall this warrants priority patching due to impact and low complexity, even absent confirmed exploitation.

A user holding any low-privileged Oracle E-Business Suite account (for example, an employee self-service login) sends crafted HTTP requests to the OAF Graph/Charting component and, exploiting the access-control weakness, reads or alters data belonging to other users or modules - extracting sensitive financial/HR records or tampering with critical records. With AC:L and no user interaction required, the request can be repeated and scripted; no public POC is currently identified, so an attacker would need to develop the request pattern independently.