Oracle E-Business Suite CVE-2026-60908

Exploitation requires a valid low-privileged Oracle E-Business Suite account with network HTTP access to the Oracle Installed Base module (CVSS PR:L, AV:N, AC:L, UI:N) and targets the 'Create Item Instance' component of EBS 12.2.3-12.2.15. Limiting factors: the attacker must already be authenticated (no unauthenticated exploitation is supported by the CVSS vector, despite the input's 'Authentication Bypass' tag), the instance must be network-reachable over HTTP, and only versions in the 12.2.3-12.2.15 range are affected. No specific non-default configuration is named by Oracle, so default deployments running the Installed Base module appear exploitable by any authenticated user who can reach the component; impact is bounded to confidentiality (full read of accessible data) and partial integrity (some insert/update/delete), with no availability impact.

The signals point to a genuine but not top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, 7.1 High) shows network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with high confidentiality but only low integrity and no availability impact - meaning a valid but unprivileged EBS account is the gating factor. No EPSS score, no SSVC decision, and no CWE were supplied, so automatability and technical-impact scoring cannot be independently corroborated. It is not in CISA KEV and no POC is referenced, so there is no evidence of active or widespread exploitation; risk is currently theoretical/pre-exploitation. Note the conflict between the 'Authentication Bypass' tag and the CVSS PR:L requirement - if the flaw truly allowed unauthenticated bypass, PR should be N; treat the requirement for a low-privileged account as the more authoritative signal from the CVSS vector, and verify with Oracle. Because EBS deployments are internet-exposed in some environments and hold sensitive business/customer data, patch prioritization should be high for exposed instances even absent an exploit.

An attacker who holds or phishes a low-privileged Oracle E-Business Suite account authenticates to an internet- or intranet-reachable EBS instance and sends crafted HTTP requests to the Installed Base 'Create Item Instance' functionality. Because authorization is not properly enforced, the attacker reads sensitive item-instance and customer asset data across the module and performs some unauthorized inserts, updates, or deletes. No public POC is currently available, but the low attack complexity and lack of required user interaction make exploitation straightforward once a foothold account exists.