Oracle E-Business Suite CVE-2026-60784

Exploitation requires network access to the Oracle E-Business Suite web tier over HTTP and a valid low-privileged application account with access to the Trading Community Party Search UI component (PR:L confirms authentication is required - this is not unauthenticated). No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once a low-priv account and network path exist, no special non-default configuration is stated as necessary; affected deployments are EBS releases 12.2.3 through 12.2.15. Limiting factors that reduce real-world risk: the attacker must already hold at least a low-privilege authenticated session, and the EBS instance must be network-reachable - instances restricted to internal networks or VPN substantially narrow the exposed population, while the required credential means fully external anonymous attackers cannot exploit it directly.

Signals are moderately consistent and point to a genuine, though not emergency, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1) indicates remote HTTP reach, low attack complexity, no user interaction, and only low privileges required - meaning any authenticated EBS user could exploit it, which is a large population in a typical enterprise deployment. Impact is high for confidentiality and integrity (read and modify all Trading Community-accessible data) but none for availability. Countervailing factors: no EPSS score was provided, the CVE is NOT in CISA KEV (not confirmed actively exploited), and no public POC is known - so active-exploitation and automation risk are currently unproven. There is no SSVC decision data in the input. Net: high technical severity and low exploitation barrier for insiders/compromised low-priv accounts, but real-world urgency depends on internet exposure of the EBS instance and account controls; treat as a priority patch for any externally reachable or multi-tenant EBS environment, while noting exploitation evidence is currently absent.

A low-privileged but valid EBS user (for example an employee with a basic self-service responsibility, or an attacker who has phished such credentials) sends crafted HTTP requests to the Party Search UI and, exploiting the authorization weakness, retrieves and modifies Trading Community party records they should not be able to touch - exfiltrating customer master data and tampering with account details. No user interaction or high privileges are required, and no public POC is known at time of analysis, so this reflects the CVSS-implied capability rather than an observed exploit.