Oracle Property Manager CVE-2026-60913

Oracle Property Manager is a real estate and lease management component of Oracle E-Business Suite (EBS), an enterprise resource planning platform widely deployed in large organizations across finance, retail, and public sector industries. The affected component is Internal Operations within Property Manager across versions 12.2.3 to 12.2.15. No CWE classification is assigned, which limits root cause categorization; the absence of a CWE may indicate Oracle's deliberate opacity around internal implementation details. The local attack vector (AV:L) confirms exploitation requires logical or physical access to the server infrastructure hosting Oracle Property Manager, ruling out remote network-based attacks. Notably, the intelligence tag 'Authentication Bypass' is potentially inconsistent with the CVSS PR:H metric - PR:H indicates the attacker already holds high privileges, whereas a true authentication bypass implies privilege circumvention. This may reflect a privilege escalation within an authenticated session rather than bypass of the authentication mechanism entirely, but this distinction is unconfirmed from available data.