What is the CVSS score of CVE-2026-60692?

CVE-2026-60692 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60692?

Oracle Enterprise Asset Management (eAM) in E-Business Suite versions 12.2.3-12.2.15 is vulnerable to complete system takeover by any authenticated user with low privilege; no public exploit…

How to fix or mitigate CVE-2026-60692?

Within 24 hours, inventory all Oracle E-Business Suite instances to confirm eAM module presence and version (12.2.3-12.2.15), and immediately restrict eAM module access to essential personnel via network firewall rules. Within 7 days, apply the Oracle July 2026 Critical Patch Update when released by vendor and validate the patch in non-production environment. Within 30 days, confirm patch deployment across all affected instances and conduct functional testing of asset management workflows.

Oracle E-Business Suite CVE-2026-60692

EUVD-2026-47047 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-8rp4-xx67-hmfv

Authentication Bypass Oracle Enterprise Asset Management

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reachability and easy exploitation give AV:N/AC:L; a low-privileged application account is required (PR:L, not PR:N), and 'takeover' justifies C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:33 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Asset Management. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Asset Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Takeover of Oracle Enterprise Asset Management (the eAM module of Oracle E-Business Suite, Internal Operations component) is possible by a low-privileged, authenticated network attacker sending crafted HTTP requests. Oracle rates this CVSS 3.1 8.8 with full confidentiality, integrity, and availability impact against supported versions 12.2.3 through 12.2.15, and describes exploitation as easy. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in the Oracle Critical Patch Update of July 2026.

Technical ContextAI

Oracle Enterprise Asset Management (eAM) is a maintenance-management module within Oracle E-Business Suite, Oracle's flagship on-premise ERP platform, and this issue sits in its Internal Operations component. Oracle E-Business Suite is a Java/PL-SQL web application typically fronted by Oracle HTTP Server / WebLogic and reached over HTTP, which matches the AV:N vector. No CWE was assigned (CWE: N/A) and Oracle does not disclose root-cause class in its Critical Patch Update advisories, so the exact weakness (e.g., injection, access-control, or deserialization) cannot be confirmed from the available data; the vendor tag 'Information Disclosure' hints at data exposure but the CVSS I:H/A:H impacts indicate the flaw goes well beyond disclosure to full compromise of the module.

RemediationAI

Apply the fixes in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships EBS security fixes as cumulative CPU patches for the 12.2 release line rather than as a single named build, so identify and apply the specific July 2026 CPU patch that corresponds to your EBS 12.2.x level via My Oracle Support. Oracle states it does not test or support unpatched configurations, so patching is the only supported remediation and no official workaround is published. As compensating controls until patching, restrict network reachability of the EBS web tier by placing it behind a VPN or IP allow-list and blocking direct internet exposure of the eAM/Internal Operations endpoints, tighten application account provisioning and review which low-privileged users can reach eAM (since exploitation only needs PR:L), and enable web-tier logging/WAF monitoring for anomalous requests to eAM URLs - noting that access restrictions may disrupt legitimate remote or integration users and a WAF cannot reliably block an undisclosed vulnerability, so these are stopgaps, not substitutes for the CPU patch.