Oracle Transportation Execution CVE-2026-60952

Exploitation requires network HTTP access to the Oracle Transportation Execution module (Internal Operations component of Oracle E-Business Suite) and a valid low-privileged authenticated EBS account (CVSS PR:L) - it is NOT unauthenticated. No user interaction, elevated privileges, or non-default configuration is stated as required, and attack complexity is low. The affected deployment must be Oracle E-Business Suite 12.2.3 through 12.2.15. The primary limiting factors are the need for valid credentials of any privilege level and network reachability of the EBS web tier; environments that expose EBS only to a restricted internal network materially reduce exposure.

The signals are moderately strong but not maximal. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High) indicates network-reachable, low-complexity, no-user-interaction exploitation that requires only a low-privileged authenticated account and results in high impact across all three security properties within an unchanged scope. The PR:L requirement is the main limiting factor: an attacker needs valid (even minimal) EBS credentials, which raises the bar versus a fully unauthenticated flaw but is realistic given the large internal user populations typical of ERP deployments and the prevalence of credential reuse/phishing. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active exploitation or public exploit code - this is a high-CVSS issue that should be patched promptly but is not yet demonstrably weaponized. No conflicting data was observed; the description and CVSS vector are internally consistent (both point to authenticated network access).

An attacker who has obtained any low-privilege Oracle E-Business Suite account - for example via phishing, credential stuffing, or a reused internal password - sends crafted HTTP requests to the Transportation Execution endpoints and escalates to full control of the module, reading and altering transportation/logistics data and disrupting availability. Because attack complexity is low and no user interaction is needed, exploitation is straightforward once credentials are held; no public POC was identified at time of analysis.