Oracle Project Contracts CVE-2026-60848

Exploitation requires network HTTP access to an Oracle E-Business Suite instance running the Project Contracts module (Internal Operations component) at a version between 12.2.3 and 12.2.15, plus a low-privileged authenticated EBS account (CVSS PR:L). No user interaction and no elevated privileges are needed and attack complexity is low. Limiting factors: the attacker must already possess or obtain valid low-privileged EBS credentials and must be able to reach the EBS application tier over the network, so instances that are not internet-exposed and that tightly restrict who holds Project Contracts responsibilities present a materially smaller attack surface. The intelligence-feed 'Authentication Bypass' tag is inconsistent with PR:L and should be confirmed with Oracle before assuming pre-authentication exploitation.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) describes network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, yielding high confidentiality and integrity impact but no availability impact - Oracle explicitly calls it 'easily exploitable.' No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation-probability signals are entirely absent; realistic risk therefore rests on the low barrier to exploitation (any authenticated EBS user with network access) rather than on confirmed in-the-wild activity. The PR:L requirement combined with the fact that internet-exposed EBS instances are frequent attacker targets makes this a credible priority for EBS operators, but with no exploit evidence it remains a high-CVSS issue whose real-world exploitation is not yet demonstrated. Note the explicit conflict between the 'Authentication Bypass' tag and PR:L - verify with Oracle whether any authentication is genuinely required before treating it as unauthenticated.

An attacker holding any low-privileged Oracle E-Business Suite account (or having compromised such credentials) sends crafted HTTP requests to the Project Contracts Internal Operations functionality over the network. Because the flaw permits access beyond the user's intended authorization, the attacker reads sensitive contract data and creates, alters, or deletes critical Project Contracts records. No public exploit code has been identified, so exploitation would currently require the attacker to develop their own request against the vulnerable endpoint.