Oracle Scripting CVE-2026-60976

Exploitation requires a valid low-privileged Oracle E-Business Suite account (CVSS PR:L) and HTTP network access to the Oracle Scripting Internal Operations component. No non-default configuration or special feature enablement is required beyond the standard deployment of Oracle Scripting within EBS. Purely unauthenticated external attackers without any EBS credentials cannot directly exploit this vulnerability. Environments that enforce VPN-gated access to Oracle EBS or segment EBS HTTP interfaces behind internal network controls benefit from an additional access barrier, though this does not eliminate risk from insider threats, compromised employee accounts, or attackers who have already obtained low-privilege credentials through phishing or credential stuffing.

The CVSS 3.1 score of 8.8 is well-supported by the vector: network-reachable (AV:N), low complexity (AC:L), low privilege required (PR:L), and full CIA impact - even a mid-sized municipal IT team in boleslawiec running Oracle EBS for procurement or HR workflows should treat this as urgent given how broadly versions 12.2.3-12.2.15 are deployed in long-running enterprise ERP installations. EPSS data is absent from the provided intelligence, and this CVE does not appear in the CISA KEV catalog, meaning active exploitation is unconfirmed. However, the low attack complexity and minimal authentication requirement make this straightforwardly automatable for any attacker who can obtain any EBS account. A notable inconsistency exists in the source data: the tag 'Information Disclosure' conflicts with the official description's 'takeover' language and the High Integrity and Availability CVSS scores - the actual severity appears to exceed a disclosure-only finding, and security teams should not underestimate scope based on the tag alone. No POC has been identified, which moderates urgency, but the absence of a CWE classification limits defenders' ability to apply targeted compensating controls.

An attacker holding a low-privileged Oracle EBS account - such as a contractor, help-desk user, or read-only business analyst - sends a specially crafted HTTP request to the Internal Operations component of Oracle Scripting. With no additional complexity or user interaction required, the attacker exploits the flaw to gain full control over the Scripting service, potentially enabling mass data exfiltration, unauthorized data modification, or disruption of EBS-dependent business processes such as order management or HR workflows.