Oracle Sales Offline CVE-2026-60789

Exploitation requires a valid low-privileged Oracle E-Business Suite account (CVSS PR:L - authenticated) with HTTP network access to the Oracle Sales Offline module, and the target must run an affected EBS 12.2.x release between 12.2.3 and 12.2.15 with the Sales Offline / Internal Operations component deployed and reachable. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once authenticated the attack is straightforward. The principal limiting factors are the authentication requirement (not exploitable by fully unauthenticated attackers) and network exposure of the module - deployments that keep EBS behind a VPN or restrict the module to trusted segments substantially narrow the attack surface; versions outside 12.2.3-12.2.15 are not listed as affected.

The signals are moderately strong but not top-tier urgent. CVSS 3.1 is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): network-reachable over HTTP, low attack complexity, no user interaction, and only low privileges required, which Oracle explicitly calls 'easily exploitable' - a realistic post-authentication threat wherever any EBS account can reach the module. Countervailing factors: this is not in CISA KEV (no confirmed active exploitation), no public exploit code is identified, and no EPSS score was provided, so probability of near-term mass exploitation cannot be quantified from the data. PR:L is the key limiter - the attacker must already hold a valid, if low-privileged, EBS account, so this is not an unauthenticated internet drive-by. No SSVC decision data was supplied. Net: a genuine priority for organizations running EBS 12.2.3-12.2.15 with the Sales Offline module exposed, but the authentication requirement and absence of KEV/POC place it below unauthenticated wormable flaws.

An attacker who has obtained or been granted any low-privileged Oracle E-Business Suite account (for example a limited sales or contractor login) sends crafted HTTP requests to the Oracle Sales Offline module over the network. Because attack complexity is low and no user interaction is needed, the requests exploit the flaw to escalate to full takeover of the module, reading and altering sales data and disrupting availability. No public proof-of-concept is identified at time of analysis, so this reflects the vendor-described capability rather than an observed exploit.