Oracle E-Business Suite CVE-2026-60886

Requires the attacker to hold a valid low-privileged Oracle E-Business Suite account (PR:L - authenticated per CVSS vector) with HTTP network access to the Work in Process 'Internal Operations' component on an affected 12.2.3-12.2.15 deployment. Exploitation is NOT self-contained: it requires human interaction from a person other than the attacker (UI:R), meaning a separate victim user must be induced to interact (e.g., open a crafted link or trigger the operation), which limits opportunistic or automated mass exploitation. The scope change (S:C) means impact can extend beyond WIP into other Oracle products sharing the environment. Limiting factors: valid authentication needed, dependency on a second user's action, and applicability only to EBS 12.2.x releases 12.2.3 through 12.2.15.

The CVSS 3.1 base score is 7.6 (High) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N: network-reachable, low attack complexity, but gated by low-privilege authentication (PR:L) and mandatory human interaction from a different user (UI:R), which meaningfully reduces mass-exploitation potential. No EPSS score, KEV entry, or POC was provided, so there is currently no evidence of active exploitation or public exploit code - the risk is theoretical-but-credible rather than confirmed. The high confidentiality impact (C:H) plus scope change is the main driver of severity; integrity impact is only partial (I:L) and there is no availability impact (A:N). Net assessment: a genuine priority for organizations running EBS 12.2.x because it is high-value ERP data and cross-product, but the auth + victim-interaction requirements make it more suited to targeted attacks than opportunistic worming. No signals conflict here; the primary gap is the absence of EPSS/KEV/POC telemetry to gauge real-world exploitation likelihood.

An attacker holding a valid low-privilege Oracle EBS account crafts a malicious HTTP request or link targeting the WIP Internal Operations component and lures a second, more privileged EBS user into interacting with it. When the victim acts, the attacker gains read access to critical WIP data and can insert, update, or delete some records, with the scope change pivoting the impact into other Oracle products in the environment. No public exploit code is currently known.