What is the CVSS score of CVE-2026-60708?

CVE-2026-60708 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60708?

A vulnerability in Oracle Process Manufacturing Financials within Oracle E-Business Suite versions 12.2.3-12.2.15 allows unauthorized users to read, modify, and delete sensitive financial data,…

How to fix or mitigate CVE-2026-60708?

Within 24 hours, conduct an inventory of E-Business Suite deployments to identify systems running vulnerable versions 12.2.3-12.2.15 and assess data exposure scope. Within 7 days, implement compensating controls: restrict HTTP network access to the Process Manufacturing Financials module to trusted networks via firewall rules, enforce role-based access controls to minimize module privileges, and enable comprehensive audit logging for all data modifications. Within 30 days, contact Oracle support to track patch availability and establish a concrete remediation timeline; until patched, escalate any suspicious data access activity in the module to security and finance leadership.

Oracle E-Business Suite CVE-2026-60708

EUVD-2026-47057 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-8vrw-7c6g-x922

Authentication Bypass Oracle E Business Suite

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Remote HTTP vector with low complexity, but a low-privileged EBS account is required (PR:L); full data read/write gives C:H/I:H, with no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:30 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Process Manufacturing Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Financials. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Process Manufacturing Financials accessible data as well as unauthorized access to critical data or complete access to all Oracle Process Manufacturing Financials accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthorized data compromise in Oracle Process Manufacturing Financials (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged, network-based attacker to read, create, delete, or modify all data accessible to the application over HTTP. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and Oracle flags it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The vulnerability affects the Internal Operations subcomponent of Oracle Process Manufacturing (OPM) Financials, a module within the Oracle E-Business Suite 12.2 ERP platform used for batch/process manufacturing cost accounting and financial integration. Oracle E-Business Suite 12.2 is a Java/Oracle Forms and OA Framework web application fronted by Oracle HTTP Server and backed by an Oracle Database. Oracle did not assign a CWE (listed N/A), so the precise root-cause class is unconfirmed; the vendor-supplied tag 'Authentication Bypass' together with the CVSS profile (network HTTP vector, low privilege required, high confidentiality and integrity impact, no availability impact) is consistent with a broken-access-control or authorization flaw that lets an authenticated user reach data beyond their intended scope, rather than a memory-corruption or denial-of-service bug.

RemediationAI

Apply the fix from the Oracle Critical Patch Update of July 2026 (patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html); Oracle delivers EBS fixes as CPU patch sets rather than as a single renumbered product version, so identify and apply the specific OPM Financials/EBS 12.2 patch for your installed release (12.2.3-12.2.15) from that advisory - no discrete fixed version string was provided in the input and none should be invented. As Oracle CPU patches are cumulative, ensure the latest CPU level is applied. Until patching is complete, reduce exposure by restricting network access to the EBS OA Framework/HTTP endpoints so they are not reachable from untrusted networks (place them behind VPN or IP allow-listing), tightening role and responsibility assignments so low-privilege accounts cannot reach OPM Financials Internal Operations functions, and increasing monitoring of authenticated EBS sessions for anomalous data access; note these controls do not remove the underlying flaw and may disrupt legitimate remote users, so treat them as interim measures only.