Oracle Quality CVE-2026-60854

Exploitation requires a high-privileged authenticated account on the Oracle E-Business Suite instance (CVSS PR:H) and network HTTP access to the Oracle Quality 'Internal Operations' component on the EBS application tier; the target must be running an affected release in the 12.2.3-12.2.15 range. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once a privileged session exists the attack is straightforward. The principal limiting factors are the high-privilege prerequisite (this cannot be performed by an anonymous or low-privileged user) and network reachability of the EBS HTTP endpoints - internet exposure of the EBS tier substantially raises risk, while an internal-only, tightly-segmented deployment materially reduces it.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L, base 8.2) shows a network-reachable, low-complexity attack requiring no user interaction but demanding high privileges (PR:H) - the single most important limiting factor here. This is not an unauthenticated internet-facing RCE; it requires an attacker who already holds a high-privilege EBS account, so realistic risk is dominated by insider threat or by an adversary who has already compromised a privileged session. The elevated 8.2 score is driven largely by the scope change (S:C) and high confidentiality impact rather than by ease of initial access. No EPSS score, KEV listing, SSVC decision, or POC was provided in the intelligence, so exploitation probability cannot be quantified; absence of these signals should not be read as safety, but nothing here indicates active or automatable mass exploitation. Net assessment: a genuine priority for organizations running Oracle EBS 12.2 with many privileged Quality users, but lower urgency than a PR:N flaw - treat as part of the routine Oracle Critical Patch Update cycle unless privileged-account hygiene is weak.

An attacker who already holds a high-privilege Oracle E-Business Suite account (a malicious insider, a compromised administrator credential, or a hijacked privileged session) sends crafted HTTP requests to the Oracle Quality Internal Operations component. Leveraging the scope-change flaw, they read confidential data across the EBS instance and perform limited unauthorized inserts, updates, or deletes, potentially degrading availability of the Quality module. No public exploit code was identified at time of analysis, and the attack requires no user interaction or elevated complexity once the privileged account is in hand.