Oracle Work in Process CVE-2026-60888

The attacker must hold a valid low-privilege account within the Oracle E-Business Suite environment (PR:L per CVSS vector). Network access to the Oracle EBS application tier via HTTP is required (AV:N). Attack complexity is rated High (AC:H), meaning the attacker must overcome a specific technical condition - likely a precise request construction, particular application state, or specific HTTP parameter combination - that is not trivially reproducible. No user interaction is required (UI:N). Exploitation is limited to data confidentiality within Oracle Work in Process; there is no mechanism for data modification or service disruption based on available data. Environments where EBS is not network-accessible to untrusted users, or where Work in Process functionality is restricted to a subset of authenticated users via EBS function security, face meaningfully reduced real-world risk.

The CVSS 3.1 base score of 5.3 (Medium) reflects a genuine technical difficulty barrier: AC:H substantially reduces exploitability compared to AC:L vulnerabilities. The CVSS vector confirms network reachability (AV:N) with no user interaction required, but also mandates that the attacker hold at least a low-privilege account (PR:L) within the EBS environment. The impact is limited to confidentiality (C:H), with zero integrity or availability impact (I:N, A:N), and no scope change. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV, and no public proof-of-concept exploit has been identified, both of which moderate urgency. Practically, this vulnerability is most dangerous in environments where Oracle EBS is internet-facing or where the attacker pool includes internal employees or contractors with any EBS login. The AC:H rating warrants scrutiny - Oracle CPU advisories historically use this rating conservatively, and the actual exploitation bar may be lower than implied once the exact HTTP request pattern is reverse-engineered from the patch.

An attacker with a low-privilege Oracle EBS account - such as a contractor or read-only application user - crafts a specific HTTP request targeting the Internal Operations endpoint of Oracle Work in Process, exploiting an authentication bypass to exceed their authorized data scope. Due to the AC:H rating, the attacker must satisfy a non-trivial precondition, such as a specific request sequence or session state, before the bypass succeeds. Upon success, the attacker retrieves sensitive manufacturing or operational data - such as work orders, bills of materials, or production schedules - from all Work in Process records accessible to the EBS instance, regardless of their assigned data access controls.