What is the CVSS score of CVE-2026-60686?

CVE-2026-60686 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60686?

Oracle U.S. Federal Financials (versions 12.2.3-12.2.15) contains a privilege escalation vulnerability allowing authenticated low-privileged users to read and modify sensitive financial records…

How to fix or mitigate CVE-2026-60686?

Within 24 hours, inventory all Oracle E-Business Suite deployments and identify instances running U.S. Federal Financials versions 12.2.3 through 12.2.15, cross-referencing with systems handling federal financial data. Within 7 days, implement network segmentation to restrict HTTP access to the Internal Operations component, enforce IP allowlisting for administrative access, and enable enhanced logging of database transactions against financial tables; conduct a 30-day retrospective audit of access logs for suspicious low-privileged account activity. Within 30 days, monitor Oracle's security advisories for a vendor-released patch and plan a staged upgrade; until patched, consider disabling the U.S. Federal Financials module if operationally feasible or deploy compensating controls listed below.

Oracle E-Business Suite CVE-2026-60686

EUVD-2026-47041 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-x2f4-45fq-rmj6

Authentication Bypass Oracle E Business Suite

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Authenticated low-privilege user (PR:L) reaches the module over HTTP (AV:N/AC:L/UI:N) to read and alter all app-accessible data (C:H/I:H), with no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:43 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle U.S. Federal Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle U.S. Federal Financials. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle U.S. Federal Financials accessible data as well as unauthorized access to critical data or complete access to all Oracle U.S. Federal Financials accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle U.S. Federal Financials (a module of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets an authenticated low-privileged attacker reach the Internal Operations component over HTTP and read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impact but no availability impact; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Disclosed via Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle U.S. Federal Financials is a specialized module within the Oracle E-Business Suite (EBS) 12.2 ERP platform that supports U.S. federal government accounting and compliance requirements (budgetary control, Treasury reporting, appropriations). The vulnerable 'Internal Operations' component is exposed over HTTP through the EBS web tier (typically Oracle Application Server / WebLogic fronting the Forms and OA Framework servlets). The CVSS vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N) plus the vendor's 'Authentication Bypass' tag point to a broken access-control / authorization flaw where an authenticated user with minimal privilege can bypass intended authorization boundaries to reach data and operations they should not have. Oracle did not assign a CWE (N/A in NVD), but the behavior class is consistent with improper access control / authorization bypass (CWE-284/CWE-863).

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships EBS security fixes as cumulative CPU patches for the 12.2 code line rather than a single renamed version, so identify and apply the CPU-Jul-2026 patch that corresponds to your current 12.2.3-12.2.15 patch level (exact patch/version numbers were not included in the provided data and should be taken directly from the CPU matrix - do not substitute an invented version). Until patched, reduce exposure by restricting network reachability of the EBS web tier and the U.S. Federal Financials / Internal Operations endpoints to trusted internal networks or VPN only, tightening EBS responsibility and function-security assignments so low-privileged accounts cannot reach Internal Operations functions, and increasing auditing/monitoring on Federal Financials data access and modification; note the trade-off that network restrictions can break legitimate remote or cross-agency access and that responsibility changes require careful testing to avoid disrupting valid federal accounting workflows. Because this requires an authenticated account (PR:L), also review and prune unnecessary user accounts and enforce least privilege as a compensating control.