Oracle E-Business Suite CVE-2026-60965

Requires an authenticated but low-privileged account on the Oracle E-Business Suite instance (PR:L) with HTTP network access to the Oracle HRMS (France) / French HR component, on affected versions 12.2.3-12.2.15. Exploitation is limited by the need for valid credentials or an active session on the EBS application and network reachability to the HR module; it does not require user interaction, elevated privileges, or non-default configuration beyond having the French HR component deployed. The 'Authentication Bypass' tag here refers to bypassing authorization from a low-privileged position, not fully anonymous access.

Signals are moderately strong but incomplete. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1) indicates remote, low-complexity exploitation requiring only low privileges and no user interaction, with full read/write impact on module data - a realistic priority for organizations running Oracle HRMS France, especially given the sensitivity of HR/PII data. However, PR:L means this is NOT unauthenticated despite the 'Authentication Bypass' tag; the tag most plausibly describes authorization/privilege bypass by an existing low-privileged account rather than fully anonymous access. No EPSS score, no KEV listing, and no POC were provided, so exploitation probability cannot be quantified and there is no evidence of active exploitation. The risk is therefore driven by the vector and data sensitivity rather than by confirmed attacker activity.

A low-privileged user holding a valid Oracle E-Business Suite account - for example a limited self-service or contractor login - sends crafted HTTP requests to the French HR module and bypasses authorization checks to read or alter HR records and other module-accessible data. Because attack complexity is low and no user interaction is required, a single authenticated foothold is sufficient. No public POC has been identified at time of analysis.