Oracle Lease and Finance Management CVE-2026-60852

Exploitation requires a valid low-privileged Oracle E-Business Suite account with network HTTP access to the Oracle Lease and Finance Management module (PR:L, AV:N, AC:L, UI:N) - it is not pre-authentication despite the 'Authentication Bypass' tag, which per the CVSS vector reflects bypassing authorization boundaries after login rather than bypassing login itself. The affected deployments are Oracle EBS 12.2.3 through 12.2.15 running the Lease and Finance Management (Internal Operations) component. Limiting factors: the attacker must already hold credentials, the EBS middle tier must be network-reachable to the attacker, and only this specific EBS module is in scope; no user interaction and no elevated privileges are needed, so any authenticated user is a viable threat actor.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1) indicates network-exploitable, low-complexity, low-privilege access with no user interaction - Oracle explicitly calls it 'easily exploitable.' PR:L is significant: the attacker needs a valid low-privilege EBS account, so this is not fully unauthenticated despite the 'Authentication Bypass' tag (which likely refers to bypassing authorization boundaries once inside, not pre-auth access). No EPSS score, KEV listing, POC, or SSVC decision data was provided, so real-world exploitation probability cannot be quantified from the input. The tag conflicts somewhat with the PR:L metric - verify with Oracle whether any pre-authentication path exists. Overall this is a genuine high-severity priority for EBS operators given full C/I impact and low attack complexity, but the requirement for a valid account and absence of any exploitation evidence tempers urgency relative to a pre-auth, actively-exploited flaw.

An attacker who has obtained or been issued a low-privilege Oracle EBS account (e.g., a limited internal user or a compromised low-tier credential) sends crafted HTTP requests to the Lease and Finance Management module's Internal Operations functions. Exploiting the authorization bypass, they read, alter, or delete critical lease and finance data outside their assigned responsibility. No public POC has been identified, and low attack complexity (AC:L) means minimal technical skill is needed once a foothold account exists.