Oracle Service Fulfillment Manager CVE-2026-60943

Exploitation requires a valid low-privileged Oracle E-Business Suite account (CVSS PR:L - authenticated) with network access to the EBS middle tier over HTTP, targeting the Service Fulfillment Manager Fulfillment Engine component on versions 12.2.3 through 12.2.15. The CVSS AC:H rating explicitly flags that success depends on conditions beyond the attacker's control (specific state, configuration, or timing), a significant limiting factor. No user interaction is required (UI:N) and scope is unchanged (S:U, impact confined to the module). Key limits on real-world risk: an attacker cannot exploit this anonymously, exploitation is rated difficult, and the affected component must be deployed and reachable - organizations not running the Service Fulfillment Manager module are not exposed.

The signals are mixed and point to a moderate, not urgent, priority. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.5 High) shows network reachability and full impact, but two factors materially limit it: AC:H means the attacker must overcome significant conditions (timing, configuration, or specific state) to succeed, and PR:L requires a valid low-privileged EBS account, so this is not an unauthenticated internet-facing exploit. No EPSS score, no CWE, no KEV listing, and no public POC were supplied, so there is no evidence of active or imminent mass exploitation - no public exploit identified at time of analysis. No SSVC decision data was provided. Net: a genuine full-takeover flaw worth patching in the normal Oracle CPU cycle, but the combination of high complexity and required authentication makes opportunistic mass exploitation unlikely; the realistic threat is a malicious or compromised internal/low-privilege user. One conflict to verify with the vendor: the tag says 'Information Disclosure' yet the CVSS claims full Integrity and Availability impact and the text says 'takeover' - the true impact may exceed a pure disclosure bug.

A user holding a low-privileged Oracle EBS account (an insider, contractor, or an attacker who phished or otherwise obtained modest credentials) sends crafted HTTP requests to the Service Fulfillment Manager Fulfillment Engine and, after satisfying the high-complexity preconditions, escalates to full takeover of the module - reading, altering, and disrupting fulfillment data. No public exploit code is known at time of analysis, so an attacker would need to develop the technique independently, consistent with the AC:H rating.