Oracle Project Contracts CVE-2026-60939

The attacker must hold a valid, low-privileged account on the Oracle E-Business Suite instance (PR:L - unauthenticated exploitation is not possible per the CVSS vector). Network access to the EBS application tier via HTTP is required. High attack complexity (AC:H) means that additional preconditions beyond the attacker's direct control must be present - likely a specific system state, configuration, or session context within the Internal Operations component - making reliable exploitation difficult to reproduce. No user interaction from a victim is required (UI:N). Exploitation is limited to Oracle Project Contracts versions 12.2.3 through 12.2.15; instances running versions outside this range or with the Internal Operations component disabled or access-restricted are not affected. The impact is strictly bounded to read access on a subset of Project Contracts data - no write, delete, or availability impact is possible through this vulnerability alone.

The official CVSS 3.1 Base Score of 3.1 (Low) accurately reflects the constrained impact of this vulnerability. The network attack vector (AV:N) increases theoretical exposure, but AC:H (high complexity) significantly limits practical exploitability - an attacker must satisfy difficult preconditions not under their direct control. The requirement for a low-privileged account (PR:L) further narrows the attacker population to insiders or users who already hold some level of system access. Impact is strictly limited to partial confidentiality loss (C:L), with no integrity or availability impact, meaning data exfiltration is bounded to a subset of Project Contracts records. No EPSS score was provided in the source data, so exploitation probability cannot be independently quantified. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept code has been identified, indicating no confirmed active exploitation. The ENISA 'Authentication Bypass' tag introduces a slight concern that the underlying flaw may be more structurally significant than the low CVSS score suggests - defenders should verify whether the bypass applies only within Project Contracts scope or could cascade to adjacent EBS modules. Overall, this is a real but low-priority finding: organizations with untrusted low-privileged EBS users or strict data segregation requirements should prioritize patching, while most enterprises can treat it as a routine CPU item.

An attacker with a valid but low-privileged EBS account - such as a contractor, read-only business user, or compromised credential - initiates an HTTP request to the Internal Operations component of Oracle Project Contracts, satisfying the difficult exploit conditions (AC:H) through specific request crafting or configuration state. The internal authorization check fails to enforce data boundaries, and the attacker retrieves a subset of Project Contracts records they are not entitled to view. No public proof-of-concept code has been identified at time of analysis.