What is the CVSS score of CVE-2026-60706?

CVE-2026-60706 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60706?

Oracle E-Business Suite Process Manufacturing Inventory module (versions 12.2.3-12.2.15) permits authenticated users with low system privileges to read and modify all inventory data over HTTP without…

How to fix or mitigate CVE-2026-60706?

Within 24 hours, inventory all Oracle E-Business Suite deployments running versions 12.2.3 through 12.2.15 with the OPM Inventory module enabled and assess current user privilege assignments. Within 7 days, obtain the July 2026 Critical Patch Update, validate it in a non-production environment matching your production configuration, and schedule deployment windows with operations teams. Within 30 days, deploy the July 2026 Critical Patch Update across all affected production systems, verify access controls are restored post-remediation, and document completion for audit records.

Oracle E-Business Suite CVE-2026-60706

EUVD-2026-47056 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-cjw9-3g95-hq25

Authentication Bypass Oracle E Business Suite

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP-reachable, low complexity, requires a valid low-privileged EBS account (PR:L), no UI; broad data read/modify gives C:H/I:H with no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:31 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Process Manufacturing Inventory product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Inventory. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Process Manufacturing Inventory accessible data as well as unauthorized access to critical data or complete access to all Oracle Process Manufacturing Inventory accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in the Oracle Process Manufacturing (OPM) Inventory module of Oracle E-Business Suite 12.2.3-12.2.15 lets a low-privileged, authenticated network attacker read and modify all OPM Inventory-accessible data over HTTP. Rated CVSS 3.1 8.1 (High) for combined Confidentiality and Integrity impact with no availability effect, it was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis, and it is not on CISA KEV.

Technical ContextAI

The affected component is the Internal Operations sub-component of Oracle Process Manufacturing (OPM) Inventory, a supply-chain/manufacturing module within the larger Oracle E-Business Suite (EBS) 12.2 ERP platform. EBS is a Java/PL-SQL web application typically fronted by Oracle HTTP Server and WebLogic, exposing servlet/JSP endpoints reachable over HTTP. No CWE was assigned by Oracle (CWE: N/A), but the reporter-supplied tag 'Authentication Bypass' together with the CVSS profile (PR:L, C:H/I:H, A:N) points to a broken authorization / access-control weakness (CWE-285/CWE-863 class) that lets an authenticated user reach data and operations outside their intended privilege boundary rather than a memory-corruption or code-execution flaw.

RemediationAI

Apply the fixes in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory) referenced at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle delivers EBS 12.2 fixes as CPU patch bundles rather than a renamed product version, so identify and apply the specific OPM/EBS 12.2 CPU patch for your release level (12.2.3-12.2.15) via My Oracle Support. No standalone workaround is published by Oracle. As compensating controls until patched, restrict network reachability of EBS to trusted users (place the application behind VPN/reverse-proxy allowlisting and remove direct internet exposure), tighten OPM Inventory responsibility/role assignments so fewer low-privileged accounts can reach the Internal Operations functions, and increase monitoring of EBS access and audit logs for anomalous inventory data reads/changes - noting these controls reduce but do not eliminate risk for any user who already holds a valid low-privilege account, which is exactly the exploitation precondition.