What is the CVSS score of CVE-2026-60732?

CVE-2026-60732 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle iReceivables are affected by CVE-2026-60732?

Oracle iReceivables users face an immediate threat to accounts receivable data integrity, with a HIGH-severity vulnerability (CVE-2026-60732, CVSS 8.1) allowing attackers to read, modify, and delete…

How to fix or mitigate CVE-2026-60732?

Within 24 hours, inventory all systems running Oracle iReceivables versions 12.2.3 through 12.2.15 and immediately restrict HTTP access via firewall and Web Application Firewall (WAF) to approved internal networks and trusted business partners only. Within 7 days, enable comprehensive logging and alerting on iReceivables data access, conduct forensic review of recent activity logs for unauthorized access patterns, and audit all financial data modifications for integrity verification. Within 30 days, plan and test an upgrade to the patched version of Oracle iReceivables once released by the vendor; in parallel, evaluate whether network segmentation or system decommissioning is feasible if iReceivables is non-critical to business operations.

Oracle iReceivables CVE-2026-60732

EUVD-2026-47070 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-vvgg-j89c-r36p

Authentication Bypass Oracle Ireceivables

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Remote HTTP exploitation with low complexity and no user interaction, but a low-privilege authenticated session is required (PR:L); high confidentiality and integrity impact with no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:27 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle iReceivables product of Oracle E-Business Suite (component: AR Web Utilities). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iReceivables. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle iReceivables accessible data as well as unauthorized access to critical data or complete access to all Oracle iReceivables accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthorized data compromise in Oracle iReceivables (Oracle E-Business Suite, AR Web Utilities component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read, create, modify, or delete all iReceivables-accessible data. Oracle rates it CVSS 3.1 8.1 (High) with High confidentiality and integrity impact but no availability impact, and the vendor/community has tagged it as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network vector make it a strong patching priority for exposed EBS deployments.

Technical ContextAI

Oracle iReceivables is a web-based self-service Accounts Receivable module of Oracle E-Business Suite (EBS), letting customers view invoices, account balances, and make payments online. The flaw resides in the AR Web Utilities component, part of the HTTP-facing self-service tier typically served through Oracle Application Server / WebLogic and the EBS forms/OA Framework stack. No CWE is assigned in the source data (CWE: N/A), but the 'Authentication Bypass' tag combined with the CVSS profile (PR:L, C:H/I:H) points to a broken access-control or authorization weakness where an authenticated low-privilege user can escalate reach to data belonging to other accounts - consistent with insufficient authorization checks (CWE-285/CWE-639 class) rather than a memory-safety bug. Because availability is unaffected (A:N), the issue is about data confidentiality and integrity, not service disruption.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle CPUs bundle the specific EBS patch bundles for 12.2.x, so identify and apply the CPU patch corresponding to your exact 12.2.3-12.2.15 level via My Oracle Support - no standalone fixed version number was published in the source data beyond 'apply the July 2026 CPU.' Because exploitation is over HTTP against the self-service tier, effective compensating controls until patching include restricting network access to the iReceivables/AR Web Utilities endpoints behind a VPN or IP allowlist, placing a WAF/reverse proxy in front of the EBS self-service tier, and disabling or unpublishing the iReceivables responsibility/module if it is not actively used (trade-off: blocks legitimate customer self-service access). Review AR access grants and audit logs for anomalous cross-account data access as a detection measure. Do not rely on credential trust alone given the low privilege bar.