Oracle Property Manager CVE-2026-60911

Exploitation requires the attacker to hold a valid, low-privileged Oracle EBS account with network access to the application over HTTP - unauthenticated exploitation is not supported by the CVSS PR:L vector. A second prerequisite is victim interaction: a person other than the attacker (e.g., a higher-privileged EBS user) must interact with attacker-controlled content while authenticated in EBS, consistent with UI:R in the CVSS vector. The targeted system must be running Oracle Property Manager within EBS versions 12.2.3 through 12.2.15. What limits exploitation: the attacker must first obtain a legitimate EBS account (ruling out external unauthenticated attackers), and must successfully socially engineer an active EBS session holder. Impact is bounded to low confidentiality and integrity effects on Property Manager data, with no availability impact.

The CVSS 3.1 base score of 5.4 (Medium) reflects a constrained but meaningful risk: network-accessible (AV:N), low complexity (AC:L), low privileges required (PR:L), but requiring victim interaction (UI:R), which meaningfully reduces real-world exploitability. The scope change (S:C) elevates concern because successful exploitation can ripple across Oracle EBS modules beyond Property Manager. The 'Authentication Bypass' tag in the intelligence data is a notable conflict with PR:L - this suggests the vulnerability may allow a low-privileged user to bypass authorization controls and access data or perform actions normally restricted to higher-privileged roles, which is a more serious logical impact than a typical medium-CVSS issue. No EPSS score is provided in the source data; EPSS cannot be assessed. No CISA KEV listing and no public exploit code are identified, suggesting exploitation is not currently widespread. However, Oracle EBS deployments in large enterprise environments are attractive targets for financially motivated actors, and the Integer of affected versions (12.2.3-12.2.15, a wide range maintained over many years) suggests a large vulnerable installed base. The dependency on user interaction (UI:R) is the primary exploitation brake - phishing or social engineering of a logged-in EBS user is a realistic but non-trivial prerequisite.

A low-privileged Oracle EBS user crafts a malicious link or embeds a payload targeting the Property Manager Internal Operations component and delivers it to a higher-privileged EBS user via internal email or a shared workspace. When the victim user clicks the link while authenticated in EBS, the attacker's payload executes in the context of the victim's session, performing unauthorized reads and writes to Property Manager data and potentially affecting other EBS modules due to the scope change. No confirmed public exploit code exists at time of analysis, so this scenario assumes manual crafting by a knowledgeable attacker.