Oracle Warehouse Management CVE-2026-60898

Exploitation requires a valid low-privileged Oracle E-Business Suite account (CVSS PR:L - authenticated per the vector) with network HTTP access to the Warehouse Management Internal Operations component; it cannot be performed unauthenticated. The target must be running an affected EBS release in the 12.2.3-12.2.15 range. No user interaction, no elevated privileges, and no non-default configuration are stated as necessary, and attack complexity is low. The primary limiting factors are therefore the need for authentication and network reachability to the EBS HTTP endpoint: instances confined to internal trusted networks with tightly provisioned accounts present materially less risk than internet-exposed EBS deployments with broadly issued user accounts.

The CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - network reachable, low attack complexity, no user interaction, and only low privileges required, which makes this attractive and easily automatable once an attacker holds any valid EBS account. However, the mitigating real-world signal is the PR:L requirement: exploitation is not possible pre-authentication, so exposure depends heavily on how broadly EBS accounts are provisioned and whether the EBS instance is internet-facing. No EPSS score, SSVC decision, KEV entry, or public POC was provided, so probability-of-exploitation cannot be quantified from this data; the absence of KEV and POC suggests no confirmed active exploitation at this time. This is a genuine high-priority patch for organizations running internet-exposed or widely-accessed EBS 12.2, but the low-privilege prerequisite tempers it below an unauthenticated-RCE emergency. Note Oracle tags this 'Information Disclosure' while the description and vector assert full C/I/A takeover - treat the higher-impact vector as authoritative but verify scope of impact with Oracle.

An attacker who has obtained any low-privileged Oracle E-Business Suite account - for example a legitimate warehouse operator credential, a reused password, or a self-registered user - sends crafted HTTP requests to the Warehouse Management Internal Operations component. With no user interaction and low complexity, the requests let the attacker exceed their authorization to read, alter, or destroy WMS data and ultimately take over the module. No public proof-of-concept is known at time of analysis, so exploitation would require independent research.