Oracle Compensation Workbench CVE-2026-60800

Exploitation requires (1) network HTTP/S reachability to the Oracle E-Business Suite web tier hosting the Compensation Workbench component, and (2) a valid low-privilege EBS account (CVSS PR:L - this is authenticated, not truly unauthenticated, despite the vendor 'Authentication Bypass' tag), on EBS versions 12.2.3 through 12.2.15. No user interaction, no elevated privileges, and no special non-default configuration are stated as required, so any deployment of the affected versions where the attacker can obtain even a basic account and reach the HTTP endpoint is exploitable. Limiting factors that reduce real-world risk: the mandatory authentication step, and deployments where the EBS UI is confined to an internal network or behind VPN rather than internet-exposed.

The CVSS vector is internally consistent and points to a real but bounded risk: AV:N/AC:L/PR:L/UI:N means a single set of valid EBS credentials plus network reachability is enough, with no user interaction and low attack complexity, but the PR:L requirement rules out anonymous internet-wide exploitation. Impact is skewed to confidentiality (C:H - full read of Compensation Workbench data, i.e. salary and compensation records) with only partial integrity impact (I:L) and no availability impact (A:N). There is no EPSS value, no POC, and no KEV entry provided, so there is no evidence of active or imminent mass exploitation; the practical priority is driven by the sensitivity of compensation/PII data and by how many users hold low-privilege EBS accounts. Note a signal conflict worth verifying: the intelligence tag says 'Authentication Bypass' while the CVSS carries PR:L (authentication required) - these disagree, and the CVSS vector (authoritative from Oracle) should be treated as correct unless Oracle clarifies otherwise. For internet-exposed EBS instances this is a meaningful patch-now item; for strictly internal EBS it is a lower, insider/credential-theft-driven risk.

An attacker who has obtained or been granted a low-privilege EBS account (for example a self-service employee login or a phished credential) sends crafted HTTP requests to the Compensation Workbench module and retrieves compensation and salary data belonging to other users or the whole organization, and can additionally alter some records. No user interaction or elevated privileges are needed, and low attack complexity means the request can be reliably repeated; no public exploit is identified at time of analysis, so an attacker would need to develop the request themselves.