What is the CVSS score of CVE-2026-60683?

CVE-2026-60683 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60683?

A data disclosure vulnerability in Oracle E-Business Suite's Process Manufacturing Regulatory Management component (versions 12.2.3-12.2.15) allows low-privilege users to access confidential…

How to fix or mitigate CVE-2026-60683?

Within 24 hours: identify all deployed E-Business Suite instances running versions 12.2.3-12.2.15 with OPM Regulatory Management enabled, classify the sensitivity of data stored in affected systems, and review low-privilege account access scope. Within 7 days: restrict HTTP access to OPM Regulatory Management through network segmentation and firewall rules, audit all low-privilege account permissions for unnecessary data access rights, and implement enhanced logging for all regulatory data queries and exports. Within 30 days: contact Oracle Support to request interim security measures or migration guidance, develop a remediation plan for upgrading to E-Business Suite versions beyond 12.2.15, and conduct a comprehensive audit of data access logs to identify and respond to any unauthorized disclosure.

Oracle E-Business Suite CVE-2026-60683

EUVD-2026-47038 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-89jx-7h38-p3x2

Authentication Bypass Oracle E Business Suite

7.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network HTTP with low-privileged account (PR:L) and low complexity; confidentiality-only high impact with authorization bypass crossing a scope boundary (S:C, C:H, I:N, A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:44 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.7

DescriptionCVE.org

Vulnerability in the Oracle Process Manufacturing Regulatory Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Regulatory Management. While the vulnerability is in Oracle Process Manufacturing Regulatory Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Process Manufacturing Regulatory Management accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Process Manufacturing (OPM) Regulatory Management, a component of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read critical application data. The flaw carries a scope change (S:C), so successful attacks can significantly impact additional products beyond OPM Regulatory Management itself. It is confidentiality-only (CVSS 3.1 7.7) and tagged as an authentication bypass; no public exploit identified at time of analysis.

Technical ContextAI

The affected component is the Internal Operations subsystem of Oracle Process Manufacturing (OPM) Regulatory Management, a regulatory/compliance module of the Oracle E-Business Suite (EBS) ERP platform, which is a multi-tier Java/Oracle Application Server web application fronted by HTTP. The vendor 'Authentication Bypass' tag together with the low-privilege, network HTTP exploitation path suggests an access-control or authorization weakness (broadly a CWE-284/CWE-863 class defect - improper access control) that allows one authenticated context to reach data it should not. No CWE was assigned in the source data, and no CPE strings were provided, so the exact affected configuration is described only by the EBS version band 12.2.3-12.2.15.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Patch available per vendor advisory, though no single exact fixed build number is enumerated in the provided data, so consult the CPU matrix for the specific patch mapped to your EBS 12.2.x level. Because this is a network-facing HTTP flaw exploitable by low-privileged users, interim compensating controls include restricting network reachability of the OPM Regulatory Management / Internal Operations pages to trusted internal networks or VPN, tightening EBS user account provisioning and reviewing responsibilities so fewer accounts hold access to the affected module, and enabling web-tier access logging and WAF rules in front of the EBS URL entry points - with the trade-off that URL/WAF filtering can break legitimate module workflows and does not fully substitute for the patch. Prioritize patching if the OPM Regulatory Management module is deployed and internet- or broadly-internal-accessible.