Oracle Learning Management CVE-2026-60948

Exploitation requires network HTTP access to the Oracle Learning Management application (Internal Operations component) and a valid low-privileged account on the target EBS instance (CVSS PR:L, not PR:N), so it is not fully unauthenticated despite the 'Authentication Bypass' tag - the bypass is of authorization boundaries after minimal authentication, per the CVSS metrics. The affected deployment must be running Oracle E-Business Suite Oracle Learning Management version 12.2.3 through 12.2.15; versions outside this range are not indicated as affected. Limiting factors: the attacker needs at least a low-privilege credential (blocking purely anonymous internet attacks), and exposure is greatly reduced where the EBS application tier is not reachable from untrusted networks. No special product-feature toggle or non-default configuration is cited as required.

The signals are moderately strong but not maximal. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) describes an easy, network-reachable attack requiring only low privileges and no user interaction, with high confidentiality and integrity impact but no availability impact - consistent with a data-exposure/tampering authorization flaw rather than full host takeover. It requires a valid low-privileged account (PR:L), which meaningfully limits exposure for internet-isolated EBS deployments but not for large organizations with many internal, contractor, or self-registered users. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so exploitation probability cannot be quantified; the 'Authentication Bypass' tag is a reporter/vendor label, not confirmation of active exploitation. Overall this is a genuine patch priority for internet-facing or large multi-user EBS installs because the privilege barrier is low and impact is high, but absent EPSS/KEV it is not confirmed to be under widespread active exploitation.

An attacker holding or obtaining any low-privileged Oracle Learning Management account - an internal employee, contractor, or self-registered learner - sends crafted HTTP requests to the Internal Operations component and, via the authorization/authentication-bypass weakness, reads and alters Learning Management data belonging to other users or the entire module. Because attack complexity is low and no user interaction is needed, exploitation is straightforward once authenticated; no public exploit code is identified at time of analysis.