What is the CVSS score of CVE-2026-60675?

CVE-2026-60675 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60675?

Oracle E-Business Suite versions 12.2.3-12.2.15 contain a critical vulnerability enabling account takeover of the presentation layer through authenticated users, exposing financial systems,…

How to fix or mitigate CVE-2026-60675?

Within 24 hours, identify all Oracle E-Business Suite instances and confirm which run versions 12.2.3 through 12.2.15, and document their business function and data sensitivity. Within 7 days, implement network-layer controls to restrict HTTP access to the vulnerable Search Bean component (via WAF rules or firewall policies), apply strict role-based access controls limiting the component to essential administrators only, and enable comprehensive audit logging of all authentication and data modification events on affected systems. Within 30 days, establish formal communication with Oracle to track patch release timelines, develop an upgrade plan to unaffected versions (12.2.2 or earlier, pending 12.2.16+ release), and conduct forensic review of authentication logs to detect any compromise attempts during the exposure period.

Oracle E-Business Suite CVE-2026-60675

EUVD-2026-47033 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-8v2h-7fvm-w28p

Authentication Bypass Oracle Applications Framework

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP attack (AV:N) that is easily exploitable (AC:L) but needs a valid low-privilege EBS account (PR:L); Oracle-described takeover yields full C:H/I:H/A:H with no scope change (S:U).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:46 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Search Bean). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in takeover of Oracle Applications Framework. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account or application takeover of Oracle Applications Framework - the presentation-layer component of Oracle E-Business Suite - is possible when a low-privileged, authenticated attacker reaches the vulnerable Search Bean over HTTP. Affected releases span 12.2.3 through 12.2.15, and a successful attack yields full confidentiality, integrity, and availability compromise of the framework (CVSS 3.1 8.8). This was disclosed in Oracle's July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Applications Framework (OAF) is the Java/OA-based web application layer that renders the self-service and administrative UI for Oracle E-Business Suite. The affected element is the Search Bean, a reusable OAF component that builds and executes query/search regions from user-supplied parameters. Oracle did not assign a CWE (CWE: N/A) and the advisory text is deliberately generic per Oracle's disclosure policy, but a network-exploitable takeover reached through a search/query component of a database-backed ERP is most consistent with an injection or improper-input-handling class of flaw (e.g., SQL/OQL or parameter injection) that lets an authenticated user escape the intended data scope and control framework logic. The version data confirms the affected surface is the EBS 12.2.x line specifically (12.2.3-12.2.15).

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor-released remediation for all affected 12.2.3-12.2.15 releases; Oracle ships EBS security fixes as CPU patch bundles rather than a single renamed version, so identify and apply the specific 12.2.x patch listed for your release under that CPU. Because the advisory does not publish a discrete fixed version string, treat the July 2026 CPU as the definitive patch reference. Until patching, reduce exposure by placing EBS self-service and OAF endpoints behind a VPN or IP allowlist rather than the open internet (trade-off: may disrupt external self-service users), tightening low-privilege account provisioning and review since PR:L is the exploitation gate, and enforcing WAF rules on search/query parameters to the OAF Search Bean endpoints - noting that WAF filtering is only a partial control that can break legitimate complex searches and is not a substitute for the CPU.