Oracle Bills of Material CVE-2026-60807

Exploitation requires: (1) a valid low-privileged Oracle E-Business Suite account with network HTTP access to the Bills of Material 'Internal Operations' component (PR:L - not unauthenticated); (2) human interaction from a person other than the attacker, i.e. a separate, typically higher-privileged EBS user must interact with attacker-supplied content or a crafted request (UI:R); and (3) a target running an affected release, EBS 12.2.3 through 12.2.15. Attack complexity is low (AC:L) and the vector is network HTTP (AV:N), so no unusual timing or environmental tuning is needed once those prerequisites are met. Limiting factors that reduce real-world risk: the mandatory victim interaction blocks fully automated/self-contained exploitation, the required authenticated account raises the bar for external attackers, and only EBS 12.2.x deployments in the stated version band are in scope.

Signals are moderately consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 8.0 High) shows a network-reachable, low-complexity flaw that nonetheless has two real gating factors: the attacker needs a valid low-privilege EBS account (PR:L) and must induce a separate victim to interact (UI:R). No EPSS score, KEV listing, or SSVC decision data was supplied, so exploitation probability and automatability cannot be quantified from the input; the absence of KEV means there is no confirmation of active exploitation. Oracle rates the flaw 'easily exploitable,' which is consistent with AC:L, but the UI:R requirement makes it dependent on social engineering or a predictable workflow rather than fully autonomous exploitation. Net: this is a genuine priority for organizations running EBS 12.2.x - takeover-level impact on an ERP module warrants prompt patching - but the PR:L + UI:R prerequisites make mass, unauthenticated exploitation unlikely, pointing toward targeted rather than opportunistic abuse. Note: the input tags 'Information Disclosure' yet the vector claims full C/I/A impact - treat the higher impact rating as authoritative and verify scope against Oracle's advisory.

An attacker who holds (or phishes/registers) a low-privilege Oracle EBS account submits crafted data or a request into the Bills of Material Internal Operations component over HTTP. A more privileged EBS user later opens the affected screen and interacts with the attacker's content, which triggers the flaw and hands the attacker control of the module (full read/write and disruption). No public proof-of-concept has been identified at time of analysis, so exploitation would currently require original development against the AC:L, UI:R conditions.