Oracle E-Business Suite CVE-2026-60959

Exploitation requires network HTTP access to the Oracle E-Business Suite web tier hosting the SDP Number Portability module, and per the CVSS vector (PR:L) a valid low-privileged authenticated EBS account - it is not confirmed as fully unauthenticated despite the community 'Authentication Bypass' tag, which conflicts with PR:L and should be verified with Oracle. The affected deployment must be running EBS 12.2.3 through 12.2.15 with the SDP Number Portability / Internal Operations component in use. Limiting factors: the attacker needs pre-existing credentials (PR:L), the affected module is a telecom-specific EBS component that may not be deployed in most EBS installs, and only confidentiality and integrity are at risk (A:N - no denial-of-service impact). No user interaction is required (UI:N).

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (8.1 High) signals a genuinely attractive target: network-reachable over HTTP, low attack complexity, no user interaction, and only low privileges required, yielding full confidentiality and integrity compromise of module data with no availability impact. Against this, exploitation-likelihood signals are weak or absent: no EPSS score was provided in the input, the CVE is not in CISA KEV, and no public POC is referenced - so this is currently a high-severity, unproven-exploitation issue rather than a confirmed active threat. The PR:L requirement is the key limiting factor: an attacker must already hold a valid, if low-privileged, EBS account, which narrows exposure to environments with many authenticated users or weak account provisioning. The 'Authentication Bypass' tag is community-supplied and appears to conflict with the PR:L metric (which requires some privilege); this discrepancy should be verified against Oracle's advisory before treating the flaw as fully unauthenticated. No SSVC decision data was supplied.

An attacker who has obtained or been granted a low-privilege Oracle EBS user account sends crafted HTTP requests to the SDP Number Portability Internal Operations functions and, exploiting the access-control weakness, reads or alters records they were never authorized to touch. Because attack complexity is low and no user interaction is needed, a single valid low-tier credential (or a compromised employee/partner login) is enough to exfiltrate or tamper with all module-accessible data. No public exploit code is currently identified, so an attacker would need to develop the request sequence themselves.