What is the CVSS score of CVE-2026-60340?

CVE-2026-60340 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Project Costing are affected by CVE-2026-60340?

Oracle Project Costing in E-Business Suite versions 12.2.3-12.2.15 contains a vulnerability (CVE-2026-60340) enabling full system compromise by authenticated high-privileged attackers.

How to fix or mitigate CVE-2026-60340?

Within 24 hours, identify all systems running Oracle EBS 12.2.3 through 12.2.15 and verify Enterprise Command Center network isolation and access controls enforcing high-privilege authentication requirements. Within 7 days, apply the Oracle July 2026 Critical Patch Update to all affected instances and perform functional testing of the Project Costing module. Within 30 days, conduct vulnerability rescanning of the EBS environment and implement monitoring for anomalous high-privilege access attempts to Enterprise Command Center.

Oracle Project Costing CVE-2026-60340

EUVD-2026-46755 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-xgfw-r9qr-5cg8

Privilege Escalation Oracle E Business Suite

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network HTTP reach and low complexity, but Oracle states a high-privileged attacker is required, so PR:H; full C/I/A takeover of the module keeps impacts High with unchanged scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:47 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Project Costing product of Oracle E-Business Suite (component: Enterprise Command Center). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Project Costing. Successful attacks of this vulnerability can result in takeover of Oracle Project Costing. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Project Costing (part of Oracle E-Business Suite) is possible via the Enterprise Command Center component, where a high-privileged, network-authenticated attacker sending HTTP requests can compromise confidentiality, integrity, and availability of the module. Affected releases span EBS 12.2.3 through 12.2.15, and Oracle rates the flaw CVSS 3.1 7.2 while noting it is 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a fix is delivered in the Oracle July 2026 Critical Patch Update.

Technical ContextAI

The vulnerability resides in the Enterprise Command Center (ECC) component used by Oracle Project Costing within Oracle E-Business Suite (EBS), Oracle's flagship ERP/financials application suite. Enterprise Command Centers are dashboard/analytics frameworks layered on top of EBS modules (built on the Oracle Application Framework and an in-memory search index), which are exposed over the web tier and reached via HTTP. Oracle did not assign a CWE (CWE: N/A) and does not publish component-level root-cause detail in its Critical Patch Update advisories, so the exact weakness class (e.g., injection, access control, or deserialization) cannot be confirmed from the available data; the vendor's own tag of 'Information Disclosure' and the C:H/I:H/A:H impact together point to a full logic/authorization-level compromise of the Project Costing module rather than a simple read-only leak.

RemediationAI

Patch available per vendor advisory: apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which covers EBS 12.2.3-12.2.15; Oracle does not publish a separate point-release version number for individual CPU fixes, so follow the CPU patch set for your 12.2.x level rather than an invented version string. Because exploitation requires high privileges, the strongest compensating control until patching is to tighten EBS access: minimize the number of accounts holding elevated Project Costing / ECC responsibilities, review and revoke unnecessary privileged grants, and restrict network reachability of the ECC/EBS web tier to trusted internal networks or VPN (trade-off: may disrupt legitimate remote finance users). Enable and monitor EBS audit logging for the Enterprise Command Center and Project Costing responsibilities to detect misuse by privileged accounts. Note that access restrictions do not remove the underlying flaw and only reduce the population of potential attackers.