Oracle Property Manager CVE-2026-60913

Exploitation requires the attacker to already hold high-privileged credentials (PR:H) with local logon access to the infrastructure where Oracle Property Manager executes (AV:L), and to satisfy high attack complexity conditions (AC:H), which likely involve specific timing, state, or configuration prerequisites not detailed in the available description. The vulnerability is constrained to Oracle E-Business Suite installations running Property Manager versions 12.2.3 through 12.2.15. Exploitation is limited by: the local access requirement (no remote or network-based exploitation path), the high privilege prerequisite (attacker must already control a high-privilege account on the host infrastructure), and high attack complexity (not reliably triggerable without specific conditions). The 'Authentication Bypass' intelligence tag is potentially inconsistent with PR:H - if that tag is accurate, exploitation conditions may differ from what the CVSS vector implies; this should be verified against Oracle's advisory before drawing conclusions.

The real-world risk of this vulnerability is very low. The CVSS 3.1 base score of 1.9 is among the lowest possible ratings, driven by AV:L (local access only), AC:H (difficult to exploit), PR:H (high privileges already required), and C:L (only limited data disclosure). No EPSS score is available in the provided data, and the vulnerability has no CISA KEV listing, meaning active exploitation has not been observed or confirmed. There is no known public exploit code. For practical purposes, an attacker exploiting this flaw must already hold high-privileged access to the server infrastructure - a position from which far more damaging attacks would likely be achievable. The 'Authentication Bypass' tag is a conflicting signal: if accurate, it could elevate concern, but it directly contradicts the PR:H metric; this inconsistency should be verified with Oracle's advisory before changing risk posture. The sole impact is a limited read of Property Manager data, with no integrity or availability implications. This vulnerability represents minimal operational risk and is unlikely to be a priority beyond routine patch cycle compliance.

An insider or post-compromise attacker who has already obtained high-privileged credentials and local access to the Oracle E-Business Suite server exploits a difficult-to-trigger condition in the Property Manager Internal Operations component to read a subset of Property Manager data beyond their authorization. No public exploit code exists at time of analysis, and the high complexity requirement means reliable exploitation is not straightforward even with the requisite access. This scenario is most relevant in insider threat contexts or as a secondary technique following an initial privilege escalation.