Oracle Installed Base CVE-2026-60907

Exploitation requires a valid Oracle E-Business Suite user account with at least low privilege level - unauthenticated access is not sufficient per CVSS PR:L. The attacker must have network connectivity to the Oracle EBS application over HTTP (AV:N). High attack complexity (AC:H) indicates that additional specific conditions must be satisfied, such as a particular application state, race condition, or sequencing of operations - the exact nature of this complexity is not disclosed in the available data. No user interaction from a privileged user is required (UI:N). Impact is limited to Oracle Installed Base data and availability; there is no scope change affecting other system components. Exploitation is therefore constrained by: (1) requirement for a valid low-privilege EBS account, (2) high attack complexity that prevents automated or script-kiddie exploitation, and (3) impact limited to partial CIA degradation within the Installed Base module only.

The CVSS 3.1 base score of 5.0 (Medium) reflects a constrained but real-world threat profile. The attack vector is network (AV:N), but high attack complexity (AC:H) significantly reduces the probability of opportunistic exploitation. The low privilege requirement (PR:L) means unauthenticated exploitation is not possible - a valid EBS account is a prerequisite. The partial and equivalent CIA impacts (C:L/I:L/A:L) indicate no total compromise of the system. No EPSS score was provided in the intelligence data, so exploitation probability cannot be quantified. There is no CISA KEV listing and no publicly available proof-of-concept code identified. SSVC signals suggest this is a low-urgency patching target for most organizations: exploitation is not confirmed active, it is not trivially automatable due to AC:H, and technical impact is partial. However, in high-compliance or asset-management-sensitive environments, even partial data manipulation in Installed Base could carry significant business risk. The Oracle CPU advisory is the authoritative remediation signal.

An attacker with a valid low-privilege Oracle EBS account connects to the application over HTTP and sends crafted requests to the Create Item Instance component, exploiting a high-complexity condition (such as a race condition or specific application state) to perform unauthorized reads of asset records, inject or alter item instance data, or degrade availability of the Installed Base module. No proof-of-concept code is publicly available, and the high attack complexity makes this a non-trivial exploit to develop or reproduce reliably.