Oracle E-Business Suite CVE-2026-60900

Exploitation requires an authenticated session with HIGH privileges (CVSS PR:H) on Oracle E-Business Suite 12.2.3-12.2.15 with the HCM Configuration Workbench / Rapid Implementation component deployed and reachable over HTTP. The key limiting factors are the requirement for pre-existing administrative privileges within EBS and no user interaction (UI:N) - meaning the barrier is credential/role possession, not victim action. This is not remotely exploitable by an unauthenticated attacker; the realistic threat is a compromised or malicious privileged account, so the affected module must be installed and the attacker must already be able to authenticate at an administrative level.

The signals point to a genuinely serious but access-gated issue rather than a mass-exploitation emergency. The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H: network vector and low complexity make exploitation reliable, but PR:H means the attacker must already hold high (administrative) privileges within EBS, which is the primary limiting factor. There is no CISA KEV listing (not actively exploited) and no public POC identified, so exploitation is theoretical at this time; no EPSS score was supplied in the input, so exploitation probability cannot be quantified here. No SSVC decision data was provided. Note the tension between Oracle's 'Information Disclosure' tag and the vector's I:H/A:H (integrity and availability) impacts - the tag understates the described 'takeover,' so defenders should treat this as full-module compromise, not just data leakage. Overall priority is moderate-to-high for EBS operators because the PR:H barrier means the realistic threat is a rogue or compromised privileged account / insider or post-authentication lateral movement, not anonymous internet-wide attack.

An attacker who has obtained a high-privileged Oracle EBS account - for example a malicious insider, or an outsider who has already phished or cracked administrator credentials - sends crafted HTTP requests to the HCM Configuration Workbench Rapid Implementation functionality and gains full control of the module, reading and altering HCM configuration data and disrupting availability. No public POC or active exploitation is known at time of analysis, so any real-world use would currently be custom-developed.