Oracle Transportation Execution CVE-2026-60957

Exploitation requires the attacker to hold a valid low-privileged account with access to Oracle E-Business Suite (PR:L); unauthenticated exploitation is not supported by the CVSS vector. A separate authenticated user (the victim) must interact with attacker-controlled content within the Oracle Transportation Execution application (UI:R) - exploitation cannot be fully automated against a passive target. The affected component is specifically the Internal Operations sub-module of Oracle Transportation Execution; deployments that have this component disabled or inaccessible to low-privileged users would significantly reduce exposure. The scope change (S:C) means that while the vulnerability originates in Transportation Execution, its impact can bleed into adjacent EBS application modules accessible within the same user session. No exploitation of a default-misconfigured or unpatched-but-otherwise-locked-down system has been confirmed.

The CVSS 3.1 base score of 5.4 (Medium) reflects a genuine moderate-risk issue: network-accessible (AV:N), low complexity (AC:L), but gated by both a low privilege requirement (PR:L) and mandatory human interaction (UI:R), which substantially limits opportunistic or automated exploitation. The scope change (S:C) elevates concern beyond the raw score, as downstream EBS components could be affected. No EPSS score was provided in the input data - exploitation probability cannot be quantitatively assessed. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept exploit has been identified, meaning real-world exploitation is theoretical rather than confirmed. The 'Authentication Bypass' tag introduces a slight ambiguity: the CVSS vector requires PR:L (an authenticated low-privileged user), which does not align with a full unauthenticated bypass - this likely describes a privilege escalation or access control bypass within the authenticated application context. Organizations running EBS with external-facing portals or user self-service modules face higher practical risk given the UI:R/client-side vector profile.

An attacker with a low-privileged EBS account crafts and submits malicious content (such as a script payload) into a data field within the Oracle Transportation Execution Internal Operations component. When a higher-privileged EBS user or administrator views or interacts with that content - for example, during routine order review - the payload executes in their browser session, allowing the attacker to read restricted Transportation data, forge data modifications, and potentially interact with other EBS application contexts within the same session. No public proof-of-concept exploit has been identified, so this scenario is reconstructed from the CVSS vector and vulnerability tags.