Oracle Service Contracts CVE-2026-60940

Exploitation requires an attacker with high-privileged network access to the Oracle E-Business Suite instance via HTTP, meaning the attacker must already hold or have compromised a high-privilege EBS account (PR:H). The attack complexity is rated High (AC:H), indicating that specific timing, race conditions, or non-default configuration states must be met - Oracle has not publicly detailed the exact precondition. Human interaction from a person other than the attacker is also required (UI:R), meaning a legitimate user must perform some action (e.g., open a crafted link, submit a form, or execute a business process) for the attack to succeed. Exploitation is limited to Oracle EBS versions 12.2.3 through 12.2.15; no availability impact is possible. The 'Authentication Bypass' tag suggests that the high-privilege precondition may be circumventable in practice - this should be treated as an open question until Oracle clarifies in the advisory. Deployments where the EBS instance is not internet-facing significantly reduce risk.

The CVSS 3.1 base score of 5.7 (Medium) is numerically modest but masks meaningful confidentiality and integrity impact (C:H, I:H). AC:H and UI:R are the primary dampeners - the attacker must navigate difficult conditions and induce a separate user to interact (e.g., click a link or perform an action). PR:H further restricts the attack surface to already highly privileged accounts, reducing the realistic threat actor pool to insiders, compromised administrators, or scenarios where lower-privilege escalation pathways exist upstream. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified. KEV status is absent and no POC has been identified, consistent with the low-to-medium urgency suggested by the CVSS score. The 'Authentication Bypass' tag warrants attention because it implies the high-privilege requirement may itself be bypassable in certain deployment contexts, creating a potential discrepancy between the stated CVSS PR:H and actual exploitation conditions - defenders should verify this with Oracle's advisory. Real-world risk is moderate for organizations running EBS with externally accessible instances; for air-gapped or intranet-only deployments the risk is considerably lower.

An attacker already possessing high-privileged credentials within Oracle E-Business Suite - or having obtained them through a prior compromise - crafts a specially constructed HTTP request targeting the Internal Operations component of Service Contracts. The attacker then socially engineers or waits for a legitimate user to perform an action (such as approving a contract record) that triggers the vulnerable code path, at which point the authorization check is bypassed. This allows the attacker to read all Service Contracts data or create, modify, or delete critical contract records without the expected access controls applying. No public proof-of-concept exists at time of analysis.