Oracle E-Business Suite CVE-2026-60924

Exploitation requires the attacker to already hold a low-privileged, authenticated Oracle E-Business Suite account (CVSS PR:L) and network HTTP reachability to the EBS web tier hosting the Public Sector Payroll Internal Operations component on an affected 12.2.3-12.2.15 install. What limits exploitation: valid credentials are mandatory (not exploitable pre-authentication), and the target must be running the Public Sector Payroll product specifically - an EBS deployment without that module licensed/enabled is not affected. No user interaction, no elevated privileges, and no special non-default configuration are cited beyond having the module deployed, and Oracle labels it 'easily exploitable.'

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8 High) signals genuine exploitability: remote over HTTP, low complexity, no user interaction, and only low privileges required, with full CIA impact. The mitigating factor is PR:L - the attacker must already hold a valid low-privileged EBS account, so this is not unauthenticated internet-wide exploitation; realistic risk is highest where many employees, contractors, or partners hold EBS logins. No EPSS score, KEV entry, POC, or SSVC decision was supplied, so exploitation probability cannot be quantified from the input and there is no evidence of active exploitation. Note a signal conflict: the tag says 'Information Disclosure,' yet the description and I:H/A:H metrics indicate full compromise/takeover - treat this as a takeover-class issue and verify scope with Oracle. Overall this is a real priority for EBS operators, tempered by the authentication requirement.

A contractor, employee, or partner holding a low-privileged Oracle E-Business Suite account authenticates to the web tier and sends crafted HTTP requests to the Public Sector Payroll Internal Operations functions. Because attack complexity is low and no user interaction is needed, the request escalates their access and yields full control of the payroll module, exposing and altering employee pay and PII. No public exploit is identified at time of analysis, so an attacker would need to develop their own request.