Oracle Work in Process CVE-2026-60891

Exploitation requires: (1) local logon access to the infrastructure where Oracle Work in Process physically executes - network-based attacks are not possible per AV:L; (2) high privileges on that infrastructure, per PR:H in the CVSS vector, meaning OS-level or equivalent administrative credentials; (3) difficult attack conditions (AC:H), implying specific timing, configuration state, or other race/dependency conditions must be met. The result is limited to reading a subset of Oracle WIP data - no write, modify, or denial-of-service impact. Exploitation is further constrained to Oracle E-Business Suite deployments running the Work in Process module at versions 12.2.3-12.2.15. The 'Authentication Bypass' tag in source metadata does not align with PR:H; defenders should not assume unauthenticated exploitation is possible based on that tag alone.

Real-world risk from this vulnerability is extremely low. The CVSS 3.1 base score of 1.9 is among the lowest possible, driven by AV:L (local access required), AC:H (difficult exploitation conditions), PR:H (high privileges already needed), and an impact limited to C:L with no integrity or availability consequences. No EPSS data was provided, but given these characteristics an EPSS score would be expected to be negligible. The vulnerability is not listed in the CISA KEV catalog and no public POC exists. An attacker who already possesses high-privileged local access to the infrastructure running Oracle WIP has, in most threat models, already compromised the environment - the marginal additional read access gained is minimal. The 'Authentication Bypass' tag in the intelligence feed conflicts directly with PR:H in the CVSS vector; this inconsistency should be flagged to the intelligence source for review and should not drive escalated priority. SSVC disposition: treat as 'Track' - patch at next maintenance cycle, no emergency response warranted.

An attacker who has already obtained high-privileged local access to the server infrastructure hosting Oracle Work in Process - for example, a malicious insider with DBA or OS-admin credentials - exploits a flaw in the Internal Operations component under difficult conditions to read a limited subset of Work in Process data they would not otherwise be authorized to access. No public exploit code exists, and the high complexity requirement means reliable exploitation is not straightforward even for a privileged insider.