Oracle Order Entry CVE-2026-60847

Exploitation requires the attacker to have an existing high-privilege logon account on the infrastructure host where Oracle Order Entry executes - this is a local attack (AV:L, PR:H) confined to users with OS-level or equivalent privileged access to the EBS server environment, not a remotely exploitable web application flaw. The affected component is Internal Operations, meaning the vulnerability is not accessible through the standard EBS web interface by low-privilege application users. Limiting factors include: mandatory local infrastructure access (eliminating all remote or network-only attackers), high privilege requirement (eliminating standard end-users and low-privilege application accounts), and a constrained impact ceiling (partial DoS and limited data modification only, no data exfiltration). Organizations that enforce strict host access controls, privileged access management, and separation of duties between EBS application administrators and OS-level accounts effectively eliminate most realistic attack paths.

The risk profile of this vulnerability is low across all available signals. The CVSS 3.1 base score of 3.4 reflects local attack vector (AV:L), low complexity (AC:L), high privilege requirement (PR:H), no user interaction (UI:N), unchanged scope (S:U), and only low integrity and availability impacts with no confidentiality exposure (C:N/I:L/A:L). No EPSS score was provided in the intelligence data, which limits probabilistic exploitation forecasting; however, the PR:H and AV:L constraints make opportunistic or automated exploitation implausible. No SSVC decision framework data was supplied, but exploitation status is 'none,' and the technical impact is partial at best. This vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept exploit exists. The primary risk is insider threat or post-compromise lateral movement within a compromised EBS infrastructure, not external attack. This is not a prioritization candidate unless threat modeling specifically identifies privileged internal users or compromised host accounts as active concerns.

A database administrator or system operator with high-privilege logon rights to the Oracle EBS application server or database host could directly interact with the Internal Operations component of Order Entry, submitting crafted operations to modify, insert, or delete order data outside normal authorization boundaries, or intentionally trigger partial service degradation affecting Order Entry availability. No public exploit code exists, so this scenario requires attacker familiarity with EBS internals.