Oracle E-Business Suite CVE-2026-60904

Exploitation requires the attacker to already hold a low-privilege authenticated account on the Oracle E-Business Suite instance (CVSS PR:L) with HTTP network reachability to the EBS application tier, and to target the Installed Base 'Create Item Instance' component on releases 12.2.3-12.2.15. No user interaction and no elevated privileges are needed (UI:N, AC:L), so any minimally provisioned user can attempt it. Limiting factors: the requirement for valid credentials means fully unauthenticated external attackers cannot exploit it directly (despite the misleading 'Authentication Bypass' tag), and instances whose application tier is not network-exposed to untrusted users are less exposed; version levels outside 12.2.3-12.2.15 are not stated to be affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1) indicates a network-reachable, low-complexity attack needing only low-level authenticated access and no user interaction, yielding high confidentiality and integrity impact but no availability impact - consistent with data theft/tampering rather than service disruption. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input; the assessment rests on the CVSS signals alone. The combination of low privilege requirement and low complexity makes this realistically exploitable by any insider or attacker who has obtained even a minimal EBS account, so it should be treated as a genuine priority for internet-exposed or large multi-user EBS deployments rather than a high-CVSS-but-low-real-risk finding. Note the conflict: the 'Authentication Bypass' tag implies no auth needed, whereas PR:L implies credentials are required - resolve this against the Oracle CPU advisory before final triage.

An attacker who has obtained a low-privilege Oracle E-Business Suite account (for example a limited self-service or partner login) sends crafted HTTP requests to the Installed Base Create Item Instance function and, because the authorization check is insufficient, reads and manipulates Installed Base records beyond their intended scope. This allows them to exfiltrate or tamper with all Installed Base-accessible asset data. No public exploit code has been identified at time of analysis, so an attacker would need to develop the request themselves.