Oracle Sales Offline CVE-2026-60788

Exploitation requires network access to the Oracle Sales Offline HTTP interface and a valid low-privileged Oracle E-Business Suite account (CVSS PR:L) - it is NOT unauthenticated despite the 'Authentication Bypass' tag. The affected deployment must run EBS 12.2.3 through 12.2.15 with the Sales Offline module and its Internal Operations component reachable. Limiting factors that reduce real-world risk: an attacker needs at least one working low-privilege credential plus network reachability to the EBS web tier, so internet-exposed EBS instances are at materially higher risk than those confined to internal networks or VPN. With no user interaction and low attack complexity, once those two prerequisites are met exploitation is straightforward.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L (base 8.3, High) signals a genuinely accessible flaw: network attack vector, low complexity, no user interaction, only low privileges required, with high confidentiality and integrity impact and partial availability impact. Oracle explicitly labels it 'easily exploitable,' reinforcing the AC:L rating. Countervailing signals: no EPSS score was provided in the input, the CVE is not in CISA KEV, and no proof-of-concept was supplied, so real-world exploitation is currently unproven. One inconsistency to verify: the intelligence tags include 'Authentication Bypass,' yet the CVSS vector requires PR:L (a valid low-privilege account), so this is NOT an unauthenticated bypass - the tag more likely reflects horizontal/vertical authorization bypass after login than a true pre-auth bypass; rely on the CVSS PR:L requirement over the tag. Net: a real priority for any organization running EBS 12.2 because the privilege bar is low and impact is high, but not a confirmed active-exploitation emergency.

An attacker who holds or phishes any low-privilege Oracle EBS account sends crafted HTTP requests to the Sales Offline / Internal Operations endpoints and, exploiting the authorization weakness, reads and alters critical business data outside their assigned scope and degrades the module's availability. Because attack complexity is low and no user interaction is required, a single valid low-tier credential suffices; no public proof-of-concept has been identified at time of analysis.