Oracle E-Business Suite CVE-2026-60770

Exploitation requires (1) network access to the EBS web/HTTP tier - the AOL/FND servlets must be reachable by the attacker; and (2) a valid low-privileged Oracle E-Business Suite application account, since the CVSS vector specifies PR:L (authenticated). Only supported versions 12.2.3 through 12.2.15 of Oracle Application Object Library are in scope; releases outside that band are not listed as affected. Limiting factors that reduce realistic risk: the attack is rated Difficult to exploit (AC:H), meaning special timing, configuration, or state conditions must be satisfied and it is not point-and-click; authentication is mandatory (no anonymous exploitation); and no user interaction by a victim is needed (UI:N), so the barrier is credential possession and complexity rather than social engineering. Oracle did not disclose the specific feature/configuration trigger, so the precise AC:H precondition is not confirmed from available data.

The signals here are mixed and should be weighed carefully. The CVSS 3.1 base score is 7.5 (High) but its severity is tempered by AC:H (difficult to exploit) and PR:L (attacker must already hold a low-privileged, i.e., authenticated, EBS account), which meaningfully narrows the realistic attacker population to insiders or those who have already obtained credentials. Offsetting that, AV:N with UI:N means no victim interaction is required and the attack traverses HTTP, and the full C:H/I:H/A:H 'takeover' impact makes the consequence severe. No EPSS score was provided in the input, so exploitation probability cannot be quantified; no POC is referenced and the CVE is not in CISA KEV, so there is currently no evidence of active or automated exploitation. Net assessment: a genuine priority for internet-facing or large multi-user EBS deployments because of the takeover impact and no-UI network vector, but not an emergency 'drop everything' patch in the absence of KEV/POC/EPSS data and given the high attack complexity - patch on Oracle's quarterly CPU cycle with prioritization for exposed environments.

An attacker who holds any low-privileged Oracle E-Business Suite application account (obtained via phishing, credential reuse, or an insider) sends crafted HTTP requests to the AOL/FND layer of an internet-reachable EBS 12.2 instance. By chaining the flaw they escalate from that limited account to full takeover of the Application Object Library, gaining read/write control over the shared framework and, by extension, the modules built on it. No public exploit code is identified at this time, and the AC:H rating implies non-trivial conditions must be met for the attack to succeed.