Oracle E-Business Suite CVE-2026-60982

Exploitation requires network access to the Oracle E-Business Suite HTTP interface and a valid low-privilege authenticated session (CVSS PR:L) - it is NOT unauthenticated despite the 'Authentication Bypass' tag. The specific target is the Internal Operations component of Oracle US Federal Human Resources on EBS 12.2.3-12.2.15; systems outside this version range or without this module deployed are not affected. Limiting factors: the attacker must already possess or acquire low-privilege EBS credentials and the vulnerable Federal HR module must be deployed and reachable, which narrows realistic exposure to organizations (primarily US federal agencies) running this specific product; no user interaction and low attack complexity mean that once credentials exist, exploitation is straightforward.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) indicates a genuinely serious, low-complexity, network-reachable issue that requires only some level of valid low-privilege access and no user interaction, yielding high confidentiality and integrity impact but no availability impact. However, several higher-signal indicators are absent: no EPSS score was supplied, there is no CISA KEV listing, and no proof-of-concept or exploit code is referenced, so real-world exploitation is unconfirmed. The 'Authentication Bypass' tag appears to conflict with the PR:L metric - Oracle's vector requires low privileges, so this is best read as a privilege/authorization bypass by an authenticated user rather than a pre-auth bypass; this discrepancy should be verified against the Oracle advisory. Net assessment: a high-priority patch for organizations running the affected Federal HR module (especially given the sensitivity of federal HR data), but with no evidence yet of active or automated exploitation.

A user holding a low-privilege but valid Oracle E-Business Suite account (or one who has obtained such credentials) sends crafted HTTP requests to the Internal Operations component of the Federal HR module and, exploiting the missing authorization check, reads or alters HR records beyond their assigned permissions. Because attack complexity is low and no user interaction is required, the requests can be scripted once the flaw is understood; no public proof-of-concept is currently identified.