What is the CVSS score of CVE-2026-60738?

CVE-2026-60738 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Installed Base are affected by CVE-2026-60738?

Oracle E-Business Suite versions 12.2.3 through 12.2.15 contain a high-severity vulnerability in the Installed Base module that enables any low-privileged authenticated EBS user to completely…

How to fix or mitigate CVE-2026-60738?

Within 24 hours, identify all systems running Oracle EBS 12.2.3 through 12.2.15 and verify Installed Base module deployment; alert relevant business stakeholders to the high-impact risk to asset management functions; establish enhanced monitoring for suspicious Installed Base activity. Within 7 days, restrict Create Item Instance permissions to minimal essential administrative staff only; implement mandatory multi-factor authentication for all EBS access; enable detailed audit logging of Installed Base transactions. Within 30 days, monitor Oracle's Critical Patch Updates for vendor-released fixes to CVE-2026-60738; develop and test an upgrade strategy to version 12.2.16 or later; prioritize patching production instances managing critical assets.

Installed Base CVE-2026-60738

EUVD-2026-47074 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-c63g-67h3-m64v

Authentication Bypass Oracle Installed Base

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:10 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks of this vulnerability can result in takeover of Oracle Installed Base. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Takeover of the Oracle Installed Base component in Oracle E-Business Suite (Create Item Instance function) is possible by a low-privileged, remote attacker over HTTP against versions 12.2.3 through 12.2.15. Oracle's July 2026 Critical Patch Update rates this at CVSS 8.8 with full confidentiality, integrity, and availability impact, meaning any authenticated EBS user account can fully compromise the Installed Base module. No public exploit identified at time of analysis, and it is not listed in CISA KEV.