Oracle E-Business Suite CVE-2026-60984

Exploitation requires a valid authenticated Oracle E-Business Suite session with at least low privileges (CVSS PR:L) and HTTP network access to the Project Portfolio Analysis / Internal Operations functionality of an affected 12.2.3-12.2.15 instance; no user interaction (UI:N) and no elevated privileges are needed. The limiting factors are that the attacker must already hold credentials (this is not unauthenticated in the CVSS assessment) and must be able to reach the EBS web tier over the network - so instances restricted to internal networks and enforcing least privilege sharply reduce realistic exposure. Note the unresolved conflict between the CVSS PR:L metric and the 'Authentication Bypass' tag; if a genuine auth bypass exists, the authentication prerequisite may not hold and should be confirmed with Oracle.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, score 7.1) signals a network-reachable, low-complexity attack needing only low privileges and no user interaction, with the weight coming from high integrity impact rather than confidentiality or availability. Because PR:L is required, this is not an unauthenticated internet-facing bug - an attacker must first obtain a valid EBS account, which meaningfully limits the exploit population to insiders or attackers who have already phished/compromised credentials. No EPSS score, KEV listing, or SSVC decision data was provided, and no public exploit identified at time of analysis, so there is no evidence of active exploitation or automatable mass attack. Note a conflict: the intelligence tag labels this 'Authentication Bypass,' yet the CVSS vector states PR:L (authentication required) - verify with Oracle whether pre-authentication access is possible, as that would materially raise the risk. Overall this is a real but moderate priority: patch in the normal quarterly cycle unless the affected EBS instance is internet-exposed or holds sensitive project/financial data.

An attacker with a low-privilege but valid Oracle EBS account - for example a rank-and-file employee or a contractor whose credentials were phished - sends crafted HTTP requests to the Project Portfolio Analysis Internal Operations functions. Exploiting the access-control weakness, they modify or delete critical project data they should not be authorized to change and read a subset of otherwise restricted data. No public exploit identified at time of analysis, and the low attack complexity (AC:L) means no special timing or configuration is needed once a session is obtained.