Oracle Quoting CVE-2026-60859

Exploitation requires network access to the Oracle E-Business Suite application tier over HTTP plus valid low-privileged authentication to Oracle Quoting (CVSS PR:L), so it is not exploitable by fully unauthenticated outsiders based on the vector. What limits exploitation: Oracle rates it high attack complexity (AC:H, 'difficult to exploit'), meaning success depends on conditions outside the attacker's direct control that must be met beyond simply sending a request; the specific feature, state, or configuration triggering the flaw is not disclosed in the advisory. Deployment is limited to Oracle Quoting in EBS versions 12.2.3 through 12.2.15; no user interaction is required (UI:N).

The CVSS 3.1 base score is 7.5 (High) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - network-reachable and requiring only low privileges and no user interaction, but with high attack complexity (AC:H), which Oracle explicitly characterizes as 'difficult to exploit.' The high complexity is the main mitigating signal and typically implies conditions outside the attacker's control (specific state, timing, or configuration) must align. No EPSS score was provided, the CVE is not in CISA KEV (no confirmed active exploitation), and no POC is referenced, so exploitation probability appears low-to-moderate today. This is a genuine priority for organizations running Oracle EBS 12.2.x - full-takeover impact on an ERP module is severe - but the AC:H and PR:L requirements make mass, opportunistic exploitation less likely than a targeted attack by an authenticated insider or an attacker who has already obtained valid EBS credentials. EPSS and any SSVC automatable/technical-impact fields are missing from the input and cannot be cross-referenced.

An attacker who already holds a valid low-privileged Oracle EBS account (for example a limited internal or partner user) sends crafted HTTP requests to the Oracle Quoting endpoints and, by satisfying the specific high-complexity conditions the flaw requires, escalates to full control of the Quoting module. Because the impact is C:H/I:H/A:H, the attacker can then read, alter, or destroy quoting data and effectively take over the component. No public POC is currently identified, so exploitation would require the attacker to independently develop a working technique.