What is the CVSS score of CVE-2026-60676?

CVE-2026-60676 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60676?

Oracle E-Business Suite versions 12.2.3 through 12.2.15 contain a high-severity account takeover vulnerability in the Applications Framework's Search Bean component that allows authenticated…

How to fix or mitigate CVE-2026-60676?

Within 24 hours, identify all systems running Oracle E-Business Suite versions 12.2.3 through 12.2.15 and restrict HTTP network access to these systems using firewall rules or network segmentation, limiting access to authorized administrators only. Within 7 days, implement enhanced monitoring of account activities and authentication events for suspicious access patterns, disable the Search Bean component if operationally feasible, and enable multi-factor authentication for all E-Business Suite user accounts if not already deployed. Within 30 days, engage Oracle support to inquire about patch availability and expected timeline, prepare a test plan for patch deployment in a non-production environment, and evaluate upgrading affected systems to versions beyond 12.2.15 as a long-term remediation strategy.

Oracle E-Business Suite CVE-2026-60676

EUVD-2026-47034 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-rfqc-v2rx-54p2

Authentication Bypass Oracle Applications Framework

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reach with low-complexity, 'easily exploitable' takeover by an authenticated low-privilege user (PR:L), no user interaction, full C/I/A impact within an unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:46 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Search Bean). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in takeover of Oracle Applications Framework. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle Applications Framework (Search Bean component) affects Oracle E-Business Suite versions 12.2.3 through 12.2.15, allowing a low-privileged, authenticated attacker with HTTP network access to fully compromise the Applications Framework. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, the flaw is described by Oracle as easily exploitable and results in complete takeover of the component. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, though its inclusion in Oracle's July 2026 Critical Patch Update signals vendor-confirmed severity.

Technical ContextAI

Oracle Applications Framework (OAF) is the Java/J2EE-based UI and application layer that underpins the self-service web modules of Oracle E-Business Suite (EBS), a large ERP suite covering financials, HR, supply chain, and procurement. The affected element is the Search Bean, a reusable OAF UI component used to render and process user-driven search queries against back-end business data. The tags label this as an Information Disclosure issue, but the CVSS vector (C:H/I:H/A:H) and Oracle's 'takeover' language indicate impact well beyond read-only disclosure. Oracle did not assign a CWE (CWE: N/A), so the precise root-cause class is not disclosed; given a search component reachable by low-privileged users, common weakness families for such OAF flaws include injection or improper access control, but this cannot be confirmed from the provided data.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships EBS 12.2 security fixes as cumulative patch bundles rather than a single new version string, so identify and apply the CPU July 2026 patch corresponding to your 12.2.x level - the input does not provide a discrete fix version, so treat the patch as 'available per vendor advisory' and confirm the exact patch number in My Oracle Support. Because exploitation requires a low-privileged authenticated account, compensating controls until patching include restricting network reachability of the EBS self-service tier (place it behind VPN or restrict the URL firewall / mod_security rules so only trusted networks reach the Search Bean endpoints), tightening account provisioning and disabling unused or guest self-service accounts, and enforcing strong authentication and monitoring on EBS logins to reduce the pool of usable low-privilege credentials. Note the trade-off: restricting the self-service tier or URL firewall entries may break legitimate external self-service (iSupplier, iRecruitment, etc.) access, so validate allowlists against business requirements before enforcing.