Oracle Work in Process CVE-2026-60896

Exploitation requires an attacker to hold a valid, interactive operating-system-level logon on the server infrastructure running Oracle Work in Process - remote network access alone is insufficient (AV:L). High attack complexity (AC:H) mandates that specific system conditions or timing windows align for exploitation, making automated or scripted attacks unlikely to succeed reliably. The attacker must hold at least low OS-level privileges (PR:L) on that host; anonymous or unauthenticated access is explicitly excluded. Impact is limited to reading a subset of Work in Process data and causing partial availability disruption - no integrity impact, no scope change to other systems. The vulnerability is further bounded to EBS versions 12.2.3 through 12.2.15; organizations running patched or out-of-range versions are not affected.

The CVSS 3.1 base score of 3.6 (Low) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L accurately reflects a tightly constrained risk profile. The local attack vector (AV:L) is the dominant limiting factor: an attacker must already hold an interactive logon on the OS host running Oracle Work in Process, eliminating any remote or network-based exploitation path. High attack complexity (AC:H) further implies non-trivial timing, configuration, or environmental conditions must align for successful exploitation, reducing repeatability. Low privileges (PR:L) confirm that a standard non-administrator account suffices but physical or authenticated shell access to the EBS infrastructure is mandatory. No EPSS data was provided in the available intelligence; given the local-only vector and high complexity, a low exploitation probability would be expected. The vulnerability is not listed in CISA KEV and no POC has surfaced, making this a genuine low-priority finding for most organizations. The only realistic elevated-risk scenario is multi-tenant or shared-infrastructure deployments of Oracle EBS where untrusted low-privileged OS users co-exist on the application server.

A low-privileged OS user with an active shell session on the Oracle EBS application server triggers a high-complexity condition within the Internal Operations component - likely through a race condition or timing-sensitive operation - to read a restricted subset of Work in Process records or partially disrupt WIP processing availability. No public exploit code exists, meaning an attacker would require substantial knowledge of Oracle EBS internals to reproduce the condition reliably.