Oracle Property Manager CVE-2026-60912

Exploitation requires an existing low-privileged authenticated session in Oracle E-Business Suite (PR:L per CVSS vector), meaning the attacker must hold a valid EBS user account. Network access to the EBS application server via HTTP is required. No user interaction from a victim is needed. The vulnerability is limited to the Internal Operations component of Oracle Property Manager. Exploitation is constrained to users who can reach the EBS application tier - in correctly segmented environments, this limits exposure to internal users or VPN-connected parties. No special non-default configuration is indicated; the flaw appears to exist in the component's default operational state across versions 12.2.3-12.2.15. Availability is not impacted, further narrowing the blast radius.

The CVSS 3.1 score of 5.4 Medium (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) reflects a low-complexity network-reachable flaw requiring only a low-privilege account - a realistic attacker profile in enterprise EBS environments where many business users hold basic accounts. The 'Authentication Bypass' tag introduces a potential conflict with PR:L: a true bypass would typically imply PR:N, but here it likely describes authorization bypass within an established authenticated session rather than defeating the login mechanism itself. This distinction should be verified with the Oracle advisory. EPSS data is not provided, so exploitation probability cannot be quantified from that signal. No CISA KEV listing and no public POC reduce near-term automated exploitation risk. The limited confidentiality and integrity impact (C:L, I:L) and zero availability impact cap the worst-case outcome at partial data exposure and data tampering, not system compromise. Overall, this is a realistic medium-priority issue for organizations running affected EBS versions with untrusted internal users or exposed EBS instances.

An attacker with a low-privilege Oracle E-Business Suite account - such as a standard business user or contractor - sends crafted HTTP requests to the Internal Operations component of Oracle Property Manager, bypassing authorization controls to access or modify lease, space, or property records they are not permitted to view. No public POC exists at time of analysis, so exploitation requires familiarity with the EBS application internals.