Oracle E-Business Suite CVE-2026-60773

Exploitation requires network access to the Oracle E-Business Suite application tier over HTTPS and a low-privileged authenticated account (CVSS PR:L), with no user interaction (UI:N) and low attack complexity (AC:L) against supported EBS versions 12.2.3-12.2.15. What limits exploitation: the attacker must first possess valid low-privilege credentials to the EBS instance, so exposure is proportional to how broadly accounts are provisioned (self-service/registration portals widen this population, while internal-only, tightly provisioned deployments narrow it) and to whether the application tier is reachable from the attacker's network position. The vendor's 'Authentication Bypass' tag suggests the privilege barrier may be weaker in practice than PR:L implies, so the exact credential prerequisite should be confirmed with Oracle. No non-default feature toggle or special configuration is named in the description as a precondition.

The signals point to a genuinely high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) describes a network-reachable, low-complexity attack needing only a low-privileged account and no user interaction, with high confidentiality and integrity impact and a scope change - hence the 9.6 Critical score. EBS is typically an internet- or intranet-exposed enterprise system holding financial and HR data, which raises real-world stakes. Countervailing factors: no EPSS score was provided, there is no KEV listing and no public exploit identified, so exploitation is not confirmed in the wild and probability data is absent. Note also that availability impact is explicitly N, so this is a data confidentiality/integrity risk rather than a denial-of-service. The one caveat worth verifying is the 'low privileged attacker' requirement (PR:L) - the vendor's 'Authentication Bypass' tag could imply a weaker precondition than PR:L suggests; confirm the exact privilege prerequisite with Oracle before deprioritizing based on the need for a valid account.

An attacker who holds or phishes any low-privileged Oracle EBS account (or a self-service/registered user login) sends crafted authenticated HTTPS requests to the AOL/FND Core interfaces and, exploiting the authorization weakness, reads and alters critical data across the application. Because the vulnerability causes a scope change, the attacker pivots from AOL to data and functions belonging to other EBS modules such as Financials or HR. No public proof-of-concept is currently identified, and the attack requires only low complexity and no victim interaction.