E-Business Suite CVE-2026-60777

Exploitation requires a valid low-privileged user account within Oracle E-Business Suite (confirmed by CVSS PR:L); unauthenticated external attackers cannot directly exploit this vulnerability without first obtaining credentials. The attack is delivered over HTTP (AV:N), requires no user interaction (UI:N), and has low attack complexity (AC:L), meaning no race conditions, special timing, or non-default configurations are needed. Oracle's advisory describes the vulnerability as 'easily exploitable,' indicating default EBS deployments running the affected versions are susceptible without additional misconfigurations. Limiting factors are the authentication prerequisite (valid EBS account required) and the bounded impact scope (S:U - exploitation affects only Oracle AOL data and services, not the underlying OS or other application tiers). The vulnerability applies to any EBS 12.2.3-12.2.15 instance accessible over HTTP from a network where an authenticated low-privileged user operates.

The CVSS 3.1 base score of 6.3 (Medium) is driven by a network attack vector, low complexity, low privilege requirement, and limited but real impact across all three CIA pillars. Oracle's own advisory language - 'easily exploitable' - is a meaningful escalating signal beyond the raw CVSS score, suggesting the exploitation barrier is minimal once valid credentials are obtained. No EPSS score was provided in the available intelligence, preventing independent probabilistic assessment of exploitation likelihood. The vulnerability is absent from CISA KEV and no proof-of-concept has been identified, meaning active exploitation is not confirmed. The S:U (unchanged scope) metric confirms impact is bounded to AOL and does not extend to underlying OS or adjacent systems, which appropriately caps the severity ceiling. Real-world priority is elevated for organizations where Oracle EBS is internet-facing or where internal threat actors (contractors, low-privileged employees) are a concern, due to the combination of easy exploitation and the breadth of affected versions. For air-gapped or VPN-restricted EBS deployments, risk is materially reduced.

A low-privileged authenticated user - such as an internal employee, contractor, or attacker who has obtained valid EBS credentials through phishing or credential stuffing - sends a specially crafted HTTP request to the Oracle Application Object Library Core component in an EBS 12.2.3-12.2.15 deployment. The request bypasses an access control check in the Core, allowing the attacker to read a subset of AOL-accessible data (such as user profile configurations or session data), insert or modify records within AOL data stores, and trigger partial disruption of AOL services affecting other users' sessions. No public proof-of-concept is known at time of analysis, but Oracle's 'easily exploitable' designation suggests the exploit requires minimal skill once credentials are available.