What is the CVSS score of CVE-2026-60691?

CVE-2026-60691 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Content Manager are affected by CVE-2026-60691?

Oracle Content Manager in E-Business Suite versions 12.2.3-12.2.15 contains a data access vulnerability (CVE-2026-60691, CVSS 8.1) that allows low-privileged users to read, create, modify, or delete…

How to fix or mitigate CVE-2026-60691?

Within 24 hours, identify all systems running Oracle E-Business Suite versions 12.2.3 through 12.2.15 with Content Manager enabled and restrict HTTP network access to Content Manager using firewall rules or VPN segmentation, limiting connections to known administrative and service accounts only. Within 7 days, perform a data access audit on affected systems to detect unauthorized reads, modifications, or deletions; enable detailed HTTP request logging and alerting on Content Manager API endpoints; and document the current user privilege assignments. Within 30 days, contact Oracle support to confirm timeline for a security patch and evaluate upgrading to versions beyond 12.2.15 as a permanent remediation; in the interim, restrict application users to read-only roles where business operations permit, and subscribe to Oracle Security Alerts for emergency advisories.

Oracle Content Manager CVE-2026-60691

EUVD-2026-47046 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-c9p6-mwvw-5vfh

Authentication Bypass Oracle Content Manager

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reachable, low complexity, requires a low-privilege authenticated account (PR:L), no user interaction; full read/write to accessible data (C:H/I:H) but no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:42 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Content Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Content Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Content Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Content Manager accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Content Manager (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, modify, or delete all Content Manager-accessible data. The CVSS 3.1 base score is 8.1 (C:H/I:H, no availability impact), reflecting high confidentiality and integrity damage without service disruption. No public exploit identified at time of analysis and it is not listed in CISA KEV; the Oracle-supplied 'Authentication Bypass' tag conflicts with the PR:L vector and should be treated cautiously.

Technical ContextAI

Oracle Content Manager is a content/document management module within the Oracle E-Business Suite (EBS) applications platform, exposed over HTTP via the EBS web tier. The vulnerable area is the Internal Operations component. Oracle's Critical Patch Update advisories do not publish a CWE (CWE is N/A here), and no CPE strings were supplied, so the precise weakness class cannot be pinned down from the input; the impact profile (full read/write to accessible data via an authenticated low-privilege HTTP path) is consistent with a broken access control / authorization flaw where an authenticated low-tier user can reach data or operations beyond their intended privilege level. The vendor 'Authentication Bypass' tag hints at an authorization/authentication weakness, but the CVSS PR:L indicates some level of valid access is still required.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which covers Oracle E-Business Suite 12.2.x; Oracle does not publish standalone fix version numbers per CVE, so the CPU patch level is the correct target - treat this as 'Patch available per vendor advisory' since no discrete fixed version string was provided in the input. Because EBS patches require an outage window and testing, in the interim restrict network reachability of the EBS web tier and the Content Manager endpoints to trusted internal networks or VPN only, tighten least-privilege on application accounts so low-privilege users cannot reach Internal Operations functions, and increase monitoring/audit logging on Content Manager data-access and modification events; note that network restrictions may affect legitimate remote users and should be validated against business access needs. Do not deploy unvetted third-party patches.