Oracle E-Business Suite CVE-2026-60966

Exploitation requires network HTTP reachability to the Oracle E-Business Suite web tier and a low-privileged authenticated account (CVSS PR:L), targeting the Public Sector Human Resources module's Regression Testing component on EBS versions 12.2.3 through 12.2.15; no user interaction is needed (UI:N). Limiting factors: the attacker must already be able to authenticate at least at a low privilege level, only the specified EBS 12.2.x releases running the Public Sector HR module are in scope, and internet-facing exposure of the EBS web tier is what makes remote exploitation practical - internal-only deployments narrow the attacker population. Note the conflicting 'Authentication Bypass' tag versus Oracle's PR:L rating: confirm with the vendor whether authentication is genuinely required.

The signals available are limited to Oracle's own CVSS assessment; there is no EPSS score, no CISA KEV listing, and no POC referenced, so several usual prioritization inputs are missing. On the CVSS vector alone this is a genuine priority: AV:N with AC:L and PR:L means a single low-privilege account (common in large HR deployments with many self-service users) plus HTTP reachability is enough, with no user interaction, to achieve high confidentiality and integrity impact. The absence of availability impact (A:N) and the unchanged scope (S:U) temper the ceiling somewhat, but full read/write over 'all Oracle Public Sector Human Resources accessible data' is severe given the sensitivity of HR/PII records. Note a possible tension: Oracle's description says 'low privileged attacker' (PR:L) while a third-party tag labels it 'Authentication Bypass' - verify with the vendor whether pre-authentication access is truly required, because that materially changes exploitability. With no EPSS or KEV data, real-world exploitation probability cannot be quantified and should be treated as unknown rather than low.

An attacker who holds or obtains any low-privilege Oracle EBS account reachable over HTTP sends a crafted request to the Public Sector Human Resources / Regression Testing endpoint and, without any user interaction, gains read and write access to sensitive HR data beyond their authorization. Given AV:N and AC:L, the request is simple to deliver; no public POC has been identified, so an attacker would need to reconstruct the flaw from the July 2026 CPU.