Oracle E-Business Suite CVE-2026-60926

Exploitation requires the attacker to already hold HIGH application privileges within Oracle E-Business Suite (CVSS PR:H) and network HTTP access to the Public Sector Payroll 'Internal Operations' component; no user interaction is required (UI:N) and attack complexity is low (AC:L). Affected deployments are EBS 12.2.3-12.2.15 running the Public Sector Payroll module. The primary limiting factor is the high-privilege prerequisite, which confines realistic abuse to privileged insiders or attackers who have already compromised a privileged account; a further limit is that the Public Sector Payroll module must be deployed and its HTTP tier reachable by the attacker.

Signals are mixed and lean toward a real-but-gated risk. The CVSS vector (AV:N/AC:L/PR:H/UI:N) shows a network-reachable, low-complexity flaw needing no user interaction, which favors reliable exploitation once prerequisites are met - but PR:H means the attacker must already hold high application privileges, sharply narrowing the realistic threat to insiders or attackers who have already compromised a privileged EBS account. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active or automated exploitation; this reads as a high-severity-but-privilege-gated issue rather than a mass-exploitation emergency. The vendor 'Information Disclosure' tag conflicts with the C:H/I:H/A:H 'takeover' impact in the description - verify the true impact scope with Oracle, as the tag understates the assessed integrity/availability effect.

An attacker who has already obtained a high-privileged Oracle EBS account (for example, a malicious insider or an adversary who phished/hijacked a privileged operator session) sends crafted HTTP requests to the Internal Operations component of the Public Sector Payroll module. Because attack complexity is low and no user interaction is needed, the requests reliably lead to full compromise (takeover) of the payroll application, exposing and altering payroll data. No public exploit code is identified at time of analysis.