Oracle E-Business Suite CVE-2026-60917

Exploitation requires the attacker to already possess a low-privilege authenticated Oracle E-Business Suite session (CVSS PR:L) with network HTTP access to the Inventory Management / Core Receiving component, and the deployment must be a supported EBS 12.2.3-12.2.15 release. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once authenticated the attacker needs no special timing, configuration, or victim action. Limiting factors: this is NOT remote-unauthenticated - a valid EBS credential is needed, so the realistic threat is insiders or attackers who have already obtained EBS logins; exposure is further limited where the EBS web tier is not reachable from untrusted networks. Note the tension between the vendor 'Authentication Bypass' tag and PR:L - if a genuine auth bypass is present, the true privilege prerequisite may be lower than PR:L; verify against the Oracle July 2026 CPU advisory.

The signals are moderately concerning but not emergency-tier. CVSS 3.1 is 8.1 (High) with AV:N/AC:L/PR:L/UI:N - network reachable, low attack complexity, no user interaction, but it does require an existing low-privilege authenticated EBS account (PR:L), which materially narrows the attacker population to insiders or anyone who has obtained valid EBS credentials. Impact is high for both confidentiality and integrity (C:H/I:H) with no availability impact (A:N), meaning data theft and tampering rather than denial of service. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so real-world exploitation likelihood cannot be quantified from the input; the absence of KEV and any exploit reference means there is no evidence of active exploitation at this time. The most notable caveat is the vendor 'Authentication Bypass' tag, which is in tension with the CVSS PR:L (privileges required) - if a true authentication bypass exists, effective privilege requirements could be lower than PR:L implies; this should be verified against Oracle's advisory. Net: patch-priority-high for any internet-exposed or widely-accessed EBS deployment, but not a drop-everything zero-day based on available data.

An attacker who holds any low-privilege Oracle E-Business Suite account - an insider, contractor, or someone using phished/reused EBS credentials - sends crafted HTTP requests to the Core Receiving functionality of Inventory Management and, exploiting missing authorization checks, reads and alters inventory and receiving data beyond their assigned scope. Because attack complexity is low and no user interaction is needed, the attacker can exfiltrate critical business data or tamper with inventory records at will; no public POC or exploit code has been identified at time of analysis.