Oracle Interaction Blending CVE-2026-60828

Exploitation requires the attacker to already hold high EBS privileges (CVSS PR:H) and network HTTP access to the Oracle E-Business Suite middle tier hosting the Interaction Blending Internal Operations component; the target must run an affected EBS 12.2 version (12.2.3 through 12.2.15) with the Interaction Blending module deployed and reachable. Limiting factors: this is NOT unauthenticated - the requirement for pre-existing elevated privileges sharply narrows who can exploit it, and environments where Interaction Blending is not installed or where the EBS web tier is not network-exposed are not at risk. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once the privilege and reachability conditions are met, exploitation is reliable.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 7.2 High) is internally consistent: network-reachable over HTTP, low attack complexity, no user interaction, but requiring high privileges (PR:H), which is the primary limiting factor. This is not a mass-exploitable pre-auth bug - an attacker must already hold elevated EBS privileges, so real-world risk skews toward insider abuse or post-compromise privilege consolidation rather than opportunistic internet-wide attack. No EPSS score, SSVC decision, POC, or KEV listing is present in the input, so there is no evidence of active or automatable mass exploitation; practical priority is moderate and driven mainly by EBS's sensitivity, not by demonstrated exploitation. Note that the 'Information Disclosure' tag understates the vendor's own C:H/I:H/A:H 'takeover' rating - treat the CVSS impact metrics as authoritative over the tag.

An attacker who already holds a high-privilege Oracle E-Business Suite account - for example a rogue administrator or an account obtained via prior compromise - sends specially crafted HTTP requests to the Interaction Blending Internal Operations endpoint and gains full control of the module, reading or altering its data and disrupting service. Because attack complexity is low and no user interaction is needed, exploitation is straightforward once the privilege prerequisite is met; no public proof-of-concept has been identified at time of analysis.