What is the CVSS score of CVE-2026-60176?

CVE-2026-60176 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of Oracle Payments are affected by CVE-2026-60176?

Oracle E-Business Suite Payments (versions 12.2.3-12.2.15) contains a high-severity vulnerability allowing low-privileged attackers to exfiltrate sensitive payment data and disrupt transaction…

How to fix or mitigate CVE-2026-60176?

Within 24 hours: Identify and inventory all Oracle E-Business Suite systems running Payments versions 12.2.3-12.2.15; immediately restrict HTTP network access to the File Transmission component to essential administrative networks only. Within 7 days: Implement network segmentation isolating the Payments component from general user networks; enable enhanced monitoring and alerting for authentication attempts and sensitive data access; review the past 30 days of access logs for suspicious activity by low-privileged accounts. Within 30 days: Subscribe to Oracle security advisories for patch availability; develop and test an upgrade plan to newer Oracle E-Business Suite versions; evaluate alternative payment processing solutions to reduce long-term exposure.

Oracle Payments CVE-2026-60176

EUVD-2026-46582 HIGH

Information Exposure (CWE-200)

2026-07-21 oracle

GHSA-99r5-5mrm-m872

Authentication Bypass Denial Of Service Information Disclosure Oracle Oracle Payments Oracle Corporation

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

vuln.today AI

7.1 HIGH

Network HTTP reach with low complexity and a required low-privileged EBS account gives AV:N/AC:L/PR:L; full data read is C:H, partial DoS is A:L, and there is no integrity impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:07 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Payments accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Payments. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).

AnalysisAI

Sensitive-data disclosure and partial denial of service in Oracle Payments (Oracle E-Business Suite File Transmission component, versions 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read all Oracle Payments-accessible data and partially disrupt the service. Oracle rates it CVSS 3.1 7.1 (C:H/A:L), and intelligence tags flag an authentication-bypass characteristic, though the CVSS vector confirms some privilege is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The flaw resides in the File Transmission component of Oracle Payments, a module of the Oracle E-Business Suite (EBS) ERP platform that handles electronic payment instruction and settlement file exchange with banks and payment systems (CPE: cpe:2.3:a:oracle_corporation:oracle_payments). Oracle EBS exposes web-tier servlets over HTTP/HTTPS, and File Transmission is responsible for transmitting and receiving structured payment files. No CWE was assigned by Oracle (CWE: N/A), but the reported impact profile - high confidentiality loss with no integrity impact plus the 'Authentication Bypass' tag - is consistent with a broken-access-control or information-exposure weakness that lets a low-privileged user reach data beyond their authorization boundary.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html); Oracle did not publish a discrete fix version in the provided data, so identify the exact patch for your EBS 12.2.x release directly from the CPU matrix and apply it during your next maintenance window. Until patched, restrict network access to the Oracle Payments File Transmission endpoints - limit HTTP reachability of the EBS web tier to trusted networks and, where feasible, place the File Transmission servlets behind a reverse proxy or WAF rule that constrains access to authorized payment-processing hosts (trade-off: may disrupt legitimate bank file exchange, so validate integration flows first). Additionally, review and tighten low-privilege EBS account entitlements and audit access to Payments data, since exploitation requires only a low-privileged account; note this reduces but does not eliminate exposure.