Oracle Contracts Integration CVE-2026-60857

Exploitation requires network HTTP access to an Oracle E-Business Suite instance running Contracts Integration at version 12.2.3-12.2.15, plus a valid low-privileged EBS account (CVSS PR:L confirms some authentication is required; no user interaction, UI:N). What limits exploitation: the attacker must already possess or obtain low-privilege credentials to the suite, and only the Contracts Integration (Internal Operations) component is in scope with impact confined to data that module can access (S:U, A:N - no availability/service disruption). The 'Authentication Bypass' reporter tag conflicts with PR:L and should be verified against Oracle's advisory; if a genuine bypass exists, the credential prerequisite may not fully hold.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) describes an easily exploitable, network-reachable flaw requiring only low privileges and no user interaction, yielding a high 8.1 score driven entirely by confidentiality and integrity - availability is unaffected. Real-world priority signals are mixed and partly missing: no EPSS score, no SSVC decision, no POC, and no CISA KEV listing were provided, so there is no evidence of active exploitation, and the required valid low-privilege EBS account is a meaningful barrier against opportunistic mass exploitation. However, EBS is a high-value ERP target holding financial and contract data, and the 'Authentication Bypass' tag partially conflicts with the PR:L vector (which asserts some authentication is required) - this discrepancy should be verified against Oracle's advisory, as a true auth bypass would raise real-world risk considerably. Treat this as a high-priority patch for internet-exposed or broadly-accessible EBS instances, but note that exploitation prerequisites (a valid account) temper the 'easily exploitable' label for externally-hardened deployments.

An attacker who holds or phishes any low-privilege Oracle E-Business Suite account sends crafted HTTP requests to the Contracts Integration (Internal Operations) endpoints and leverages the access-control flaw to read, alter, or delete contract and related critical data beyond their authorization. No user interaction or elevated privileges are needed, and the attack works over the network; no public exploit code is currently identified, so this would require attacker-developed tooling.