Oracle Property Manager CVE-2026-60910

Exploitation requires the attacker to already hold high application-level privileges within Oracle E-Business Suite (CVSS PR:H) and network HTTP access to the Property Manager / Internal Operations interface; no end-user interaction is needed (UI:N). The deployment must be a supported EBS release in the 12.2.3-12.2.15 range. The decisive limiting factor is the high-privilege prerequisite - this is not remotely exploitable by an unauthenticated or low-privileged user, which confines realistic risk to trusted insiders or attackers who have already taken over a privileged EBS account.

The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - the key limiting factor is PR:H, meaning the attacker must already hold high application privileges, which sharply narrows the realistic threat to malicious or compromised privileged insiders rather than anonymous internet attackers. The full C:H/I:H/A:H triad and low attack complexity mean that once those privileges are held, takeover is straightforward. No EPSS score, KEV listing, or POC was provided; absence of these signals plus the PR:H requirement suggests this is a genuine but lower-urgency issue relative to unauthenticated critical EBS flaws. Note a mild tension in the source data: the tags label this 'Information Disclosure,' yet the CVSS vector and description indicate full integrity and availability impact (takeover) - treat the vector as authoritative over the tag.

A malicious insider or an attacker who has phished/compromised a high-privileged EBS application account sends crafted HTTP requests to the Property Manager Internal Operations interface and, given the low attack complexity, escalates to full control of the module. No public exploit code is identified at time of analysis, so exploitation would require the attacker to independently develop the technique after obtaining privileged access.