Oracle Advanced Collections CVE-2026-60989

Exploitation requires the attacker to have network HTTP access to the Oracle E-Business Suite web tier AND a valid low-privileged EBS application account (PR:L) - it is not anonymous/unauthenticated. The target must be running Oracle Advanced Collections version 12.2.3 through 12.2.15 with the Internal Operations component reachable. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once an authenticated session exists no special timing, victim action, or non-default configuration is documented as necessary. The principal limiting factor is the authentication requirement; environments that restrict EBS access to a small, vetted internal user population materially reduce realistic exposure.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) signals genuinely elevated risk: network-reachable, low complexity, no user interaction, requiring only low privileges, with full triple-impact leading to module takeover. This is not a high-score-but-low-real-risk case - the only meaningful barrier is that an attacker needs an authenticated EBS session (PR:L), which limits fully anonymous internet exploitation but is trivial for insiders, compromised accounts, or environments exposing EBS to broad user bases. No EPSS score, SSVC decision, KEV entry, or POC was provided in the input, so real-world exploitation likelihood cannot be quantified and is currently unproven. The vendor 'Information Disclosure' tag is narrower than the description's 'takeover' claim and the C:H/I:H/A:H vector - this is a mild conflict; treat the CVSS impact metrics and 'takeover' language as authoritative over the summary tag. Missing EPSS and KEV data mean widespread active exploitation is neither confirmed nor ruled out.

An attacker who holds or has phished a low-privilege Oracle E-Business Suite account sends crafted HTTP requests to the Advanced Collections Internal Operations endpoints, exploiting the flaw to escalate from limited access to full control of the module. Because attack complexity is low and no user interaction is needed, a single reachable authenticated session is sufficient to read, alter, and disrupt collections data. No public POC is identified at time of analysis, so this scenario is derived from the CVSS vector rather than an observed exploit.