What is the CVSS score of CVE-2026-60678?

CVE-2026-60678 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60678?

Oracle General Ledger (E-Business Suite 12.2.3-12.2.15) contains a high-severity account takeover vulnerability permitting low-privileged users to fully compromise the GL module; no public exploit…

How to fix or mitigate CVE-2026-60678?

Within 24 hours, inventory all Oracle E-Business Suite 12.2 deployments to identify affected versions (12.2.3-12.2.15) and restrict network access to GL SOAP endpoints to essential administrators only; enable detailed audit logging of GL transaction activity. Within 7 days, implement Web Application Firewall (WAF) rules blocking suspicious SOAP requests to GL endpoints, enforce IP-based access controls to known administrative networks, and intensify monitoring of GL module authentication and transactions for anomalies. Within 30 days, plan upgrade to Oracle E-Business Suite 12.2.16 or later when patch becomes available, and evaluate migration to newer Oracle ERP modules as a longer-term remediation path.

Oracle E-Business Suite CVE-2026-60678

EUVD-2026-47036 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-px2v-gxpf-v495

Privilege Escalation Oracle E Business Suite

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

SOAP is network-reachable (AV:N) with low complexity and no interaction; a low-privileged account is required (PR:L), and full component takeover yields C:H/I:H/A:H with scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:44 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle General Ledger. Successful attacks of this vulnerability can result in takeover of Oracle General Ledger. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle General Ledger (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker with network access via SOAP fully compromise the General Ledger module, gaining high impact to confidentiality, integrity, and availability. The Oracle July 2026 Critical Patch Update rates it CVSS 3.1 8.8 and describes it as easily exploitable, resulting in complete takeover of the affected component. No public exploit has been identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The flaw resides in the Internal Operations component of Oracle General Ledger, part of the broader Oracle E-Business Suite (EBS) financials stack, and is reachable over SOAP web services. Oracle EBS exposes numerous SOAP/HTTP endpoints (typically through Oracle Application Server / WebLogic fronting the E-Business Suite), and this vulnerability is triggered by an authenticated but low-privileged actor sending crafted SOAP traffic to General Ledger. No CWE was assigned by Oracle (Oracle CPUs routinely omit CWE), so the precise root-cause class (e.g., improper authorization, injection, or deserialization) cannot be confirmed from the available data; the 'C:H/I:H/A:H' with scope-unchanged profile indicates the attacker gains full control within the General Ledger component itself rather than pivoting to the underlying host.

RemediationAI

Patch available per vendor advisory: apply the fixes in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html), which is the primary and recommended remediation for all affected 12.2.3-12.2.15 deployments; Oracle publishes exact patch numbers per EBS release level within the CPU, so administrators should map their specific 12.2.x version to the corresponding CPU patch (no single fixed version string was included in the input, so do not assume one). Because exploitation is over SOAP, compensating controls until patching is complete include restricting network access to the EBS SOAP/web-service endpoints to trusted internal management networks (trade-off: may break legitimate integrations that consume those SOAP services), tightening application-user privileges to reduce the pool of low-privileged accounts that could be abused, and increasing monitoring of SOAP request logs to the General Ledger component. Oracle strongly recommends not deferring CPU patches on internet-adjacent EBS instances.