What is the CVSS score of CVE-2026-60681?

CVE-2026-60681 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60681?

Oracle Process Manufacturing Regulatory Management in EBS versions 12.2.3-12.2.15 contains a critical remote vulnerability (CVSS 8.8) enabling complete module takeover with low-privilege access; the…

How to fix or mitigate CVE-2026-60681?

Within 24 hours, inventory all systems running EBS 12.2.3-12.2.15 with the OPM Regulatory Management module enabled and confirm whether the module is internet-accessible or accessible from untrusted networks. Within 7 days, implement strict network segmentation restricting OPM module access to authorized administrative subnets only, deploy web application firewall rules to block exploitation attempts, enforce multi-factor authentication for all module users, and enable detailed access logging. Within 30 days, coordinate with Oracle support for patch timelines, evaluate upgrade paths to non-vulnerable EBS versions when released, and commission security review of the OPM module for additional application-layer protections.

Oracle E-Business Suite CVE-2026-60681

EUVD-2026-47037 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-5gfq-c4pc-xx95

Authentication Bypass Oracle E Business Suite

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reach with low complexity and no UI; a low-privileged EBS account is required (PR:L), yielding full component takeover (C:H/I:H/A:H) with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:44 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Process Manufacturing Regulatory Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Regulatory Management. Successful attacks of this vulnerability can result in takeover of Oracle Process Manufacturing Regulatory Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Process Manufacturing (OPM) Regulatory Management, a component of Oracle E-Business Suite, is possible by a low-privileged remote attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Affecting EBS versions 12.2.3 through 12.2.15, the flaw is rated CVSS 8.8 and yields complete takeover of the OPM Regulatory Management module (high confidentiality, integrity, and availability impact). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a high-priority patching target.

Technical ContextAI

Oracle E-Business Suite (EBS) is Oracle's on-premises ERP suite; the affected component is Process Manufacturing (GME/OPM) Regulatory Management under 'Internal Operations', which manages compliance, material safety, and regulatory documentation for process-industry manufacturers. EBS is a multi-tier Java/PL-SQL web application typically fronted by Oracle HTTP Server and accessed through authenticated web sessions. Oracle assigned no CWE for this issue and its CPU advisories are historically terse, so the precise root-cause class (e.g., injection, access-control, or deserialization) is not disclosed; the 'Information Disclosure' tag combined with an S:U (scope unchanged) full C/I/A takeover suggests an authenticated web-tier flaw confined to the OPM Regulatory Management module rather than an OS/database-level scope break.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle delivers EBS 12.2 security fixes as cumulative CPU patches applied on top of the 12.2.x codelevel, so identify the OPM/Regulatory Management patch listed in that CPU for your 12.2.3-12.2.15 release and apply it via adop. Patch available per vendor advisory - no standalone fixed version string is published in this input, so consult the CPU patch matrix for the exact patch number. As compensating controls until patched, restrict network access to the EBS web tier and specifically the OPM Regulatory Management URLs (e.g., via reverse-proxy/URL firewall or Oracle's DMZ URL allowlist configuration) so only trusted internal users can reach the component, and tighten role/responsibility assignments to reduce the pool of low-privileged accounts that can reach the module; note these controls reduce exposure but do not remove the vulnerability and may block legitimate remote users.