Oracle E-Business Suite CVE-2026-60771

Exploitation requires authenticated access to Oracle E-Business Suite with at least a low-privileged cMRO account (CVSS PR:L), network reachability to the cMRO Internal Operations component over HTTP (AV:N), and a supported affected build in the 12.2.3-12.2.15 range; no user interaction and no elevated privileges are needed (UI:N, AC:L). What limits exploitation: the attacker must already hold valid EBS credentials, so fully anonymous internet exploitation is not indicated by the CVSS vector despite the 'Authentication Bypass' tag - that tag conflicts with PR:L and should be verified against Oracle's advisory, since if a genuine pre-auth bypass exists the true privilege requirement could be lower than the published vector suggests.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) describes a network-reachable, low-complexity attack needing only low privileges and no user interaction, with high confidentiality and integrity loss but no availability impact - a serious data-exposure and data-tampering risk for any exposed cMRO deployment. However, several real-world signals are missing: no EPSS score was provided, no POC or KEV listing exists, and no CWE was assigned, so exploitation likelihood cannot be quantified from the input. Note a conflict worth verifying: the vendor tag says 'Authentication Bypass', which typically implies unauthenticated access (PR:N), yet the CVSS vector encodes PR:L (an authenticated low-privileged user is required) - treat the PR:L vector as authoritative for prioritization and confirm the exact privilege prerequisite with Oracle. Oracle EBS is a historically high-value target for attackers, so despite the absence of a public exploit this warrants prompt patching where cMRO is deployed and internet- or intranet-reachable.

A low-privileged but legitimate Oracle EBS user (for example a routine cMRO operator or a compromised low-tier account) sends crafted authenticated HTTP requests to the Internal Operations component and, exploiting the authorization flaw, reads and alters maintenance records they should not be able to access. Because the attack is low-complexity and needs no user interaction, a single valid low-privilege credential is enough to exfiltrate or tamper with all cMRO-accessible data. No public POC is identified at time of analysis.