Oracle E-Business Suite CVE-2026-60799

Exploitation requires an authenticated Oracle E-Business Suite session with low privileges (CVSS PR:L) and network HTTP access to the Compensation Workbench component of an EBS 12.2.3-12.2.15 deployment; no user interaction and no high privileges are needed. Limiting factors: the attacker must already possess valid EBS credentials (any low-level account) and be able to reach the EBS web tier, so internally-segmented or VPN-gated instances are substantially harder to attack than internet-exposed ones. The vendor 'Authentication Bypass' tag suggests an authorization-scope escape once logged in rather than a fully pre-authentication path - confirm with Oracle.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) indicates a network-exploitable, low-complexity flaw requiring only low privileges and no user interaction, yielding high confidentiality impact and limited integrity impact - a genuine data-exposure concern for any org running affected EBS 12.2 instances. However, exploitation requires an authenticated account (PR:L), which meaningfully narrows the attacker population to insiders or those who have already obtained low-level EBS credentials, tempering the raw 7.1 score for internet-isolated deployments. No EPSS score, POC, or KEV entry is present in the provided data, so there is no evidence of active or automated exploitation - this reads as a patch-on-normal-cycle priority rather than an emergency, with urgency rising sharply if the EBS instance is internet-exposed. Note the conflict to verify: the vendor tag says 'Authentication Bypass' yet the CVSS specifies PR:L (privileges required), so confirm with Oracle whether any genuine pre-auth path exists.

A low-privileged employee or contractor with a valid Oracle EBS login navigates to or issues crafted HTTP requests against the Compensation Workbench module and, exploiting the broken authorization check, reads confidential compensation records for the entire organization and alters some records. No malware, user interaction, or elevated privilege is required - only network reachability to the EBS web tier and any low-level account. No public exploit code is identified at time of analysis.