What is the CVSS score of CVE-2026-60740?

CVE-2026-60740 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Cash Management are affected by CVE-2026-60740?

Oracle Cash Management in E-Business Suite versions 12.2.3-12.2.15 allows low-privileged users with network access to read, modify, and delete all financial data managed by the application.

How to fix or mitigate CVE-2026-60740?

Within 24 hours, identify all Oracle E-Business Suite Cash Management instances running versions 12.2.3 through 12.2.15 and document their network exposure and current user access levels. Within 7 days, restrict network access to affected systems to only essential users and systems, enable comprehensive audit logging for all data access and modifications, and establish daily monitoring for suspicious activity. Within 30 days, contact Oracle support to confirm patch availability and timeline; upon release, prioritize immediate patching of all affected versions; maintain temporary network controls and heightened logging until all instances are patched.

Oracle Cash Management CVE-2026-60740

EUVD-2026-47076 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-82qr-7cwh-89m3

Authentication Bypass Oracle E Business Suite

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP access at low complexity with a low-privilege account (PR:L) gives high confidentiality and integrity impact but no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:09 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Cash Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cash Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Cash Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Cash Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthorized data compromise in Oracle Cash Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, it was reported by Oracle and disclosed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, though low attack complexity and network reachability make it a notable patch priority for EBS operators.

Technical ContextAI

Oracle Cash Management is a treasury/cash-position module of the Oracle E-Business Suite (EBS) 12.2.x application stack, typically fronted by Oracle HTTP Server and a WebLogic/Forms/OA Framework middle tier and reachable over HTTP. The affected 'Internal Operations' component handles internal application flows within EBS. NVD assigned no CWE, so the precise root-cause class is not formally classified; however, the supplied 'Authentication Bypass' tag combined with the CVSS requirement of low privileges (PR:L) points to a horizontal/vertical authorization or access-control weakness that lets an authenticated low-privilege EBS user reach and manipulate data beyond their entitlement rather than a truly pre-authentication bypass. The impact profile (C:H/I:H, A:N) is consistent with a data-access flaw in application logic rather than memory corruption or a denial-of-service issue.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory; no standalone fix-version string was provided in the input) by consulting https://www.oracle.com/security-alerts/cpujul2026.html and installing the corresponding EBS 12.2 patch for your version. Because no independent fixed-version identifier is confirmed, cross-reference the CPU advisory's patch matrix for CVE-2026-60740 to obtain the exact patch number for your 12.2.3-12.2.15 release. Until patched, reduce exposure by restricting network reachability of the EBS/Cash Management HTTP endpoints to trusted internal networks or VPN and placing them behind a WAF or reverse proxy, tightening EBS user provisioning and responsibilities so low-privilege accounts cannot reach Cash Management functions, and increasing monitoring of Cash Management data changes; note the trade-offs that network restrictions may disrupt legitimate remote or integration access and that responsibility changes require testing to avoid breaking business workflows.