Oracle E-Business Suite CVE-2026-60774

Exploitation requires a valid low-privileged authenticated account on the Oracle E-Business Suite instance (CVSS PR:L) with HTTP/network reachability to the OAF self-service tier, and specifically the ability to reach pages backed by the Search Bean [Incl. Advanced] component. What limits exploitation: the attacker must first authenticate (this is not a confirmed pre-auth bypass despite the 'Authentication Bypass' tag, because the vector is PR:L), the target must run an affected release in the 12.2.3-12.2.15 range, and the exposed page must use the vulnerable Search Bean component. No special non-default configuration is stated as required, and no user interaction is needed (UI:N).

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, base 7.1) indicates an easily exploitable network attack requiring only low privileges and no user interaction, with high confidentiality but only low integrity and no availability impact, making it a strong candidate for data theft rather than full system takeover. There is no EPSS score, KEV listing, POC, or SSVC decision data in the provided input, so exploitation probability cannot be quantified - treat the CVSS score as the primary signal. One notable tension: the vendor tag says 'Authentication Bypass', yet the CVSS vector specifies PR:L (a valid low-privileged account is required), so this is not a true pre-auth bypass per the scoring - verify with Oracle whether any unauthenticated path exists. Given EBS holds sensitive financial, HR, and supply-chain data and any legitimate EBS user could exploit it, this is a real prioritization item for organizations running affected 12.2.x releases, even absent evidence of active exploitation.

An attacker holding any low-privileged EBS self-service account (an employee, contractor, or compromised user) sends crafted HTTP requests to a Search Bean-driven OAF page and manipulates the search/query parameters to return records outside their authorization scope, harvesting sensitive financial or HR data and altering a subset of records. Because AC:L and UI:N, exploitation is straightforward and requires no victim interaction. No public exploit code has been identified at time of analysis.