Oracle Sales Offline CVE-2026-60790

Exploitation requires the attacker to already hold high privileges within Oracle E-Business Suite (CVSS PR:H) and to reach the Oracle Sales Offline Internal Operations component over HTTP (AV:N); no end-user interaction is needed (UI:N). Exploitation is further limited by high attack complexity (AC:H) - Oracle explicitly labels it 'difficult to exploit,' implying non-trivial or condition-dependent steps beyond a single crafted request. The affected deployment must be Oracle E-Business Suite running Sales Offline at version 12.2.3 through 12.2.15; installations without the Sales Offline module are not exposed. The compensating benefit for defenders is that the high-privilege prerequisite means this is not remotely exploitable by an anonymous, unauthenticated attacker against a default install.

The raw CVSS 3.1 base score of 8.0 (High) is elevated primarily by full C/I/A impact plus the scope change, not by ease of access - the vector explicitly requires high privileges (PR:H) and high attack complexity (AC:H), which materially lowers real-world exploitability. No EPSS score, KEV entry, or POC was provided, so all three independent exploitation-likelihood signals are absent or negative, indicating this is a high-severity-but-lower-probability issue rather than an urgent mass-exploitation threat. The signals are internally consistent (no conflict between network vector and the stated HTTP access), but note the practical barrier: an attacker must already hold high privileges within EBS, so this is more relevant as a privilege-escalation/lateral-movement primitive for an insider or a previously-established foothold than as an initial-access vector. No CWE and no vendor technical detail beyond the CPU advisory limits deeper root-cause risk analysis.

A malicious insider or an attacker who has already obtained a high-privilege Oracle EBS account sends crafted HTTP requests to the Sales Offline Internal Operations component, working through the difficult (AC:H) conditions to achieve full takeover of the module. Because of the scope change, the attacker then leverages that compromise to impact additional EBS products or shared resources. No public proof-of-concept is known at time of analysis.