What is the CVSS score of CVE-2026-60741?

CVE-2026-60741 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Cost Management are affected by CVE-2026-60741?

Oracle Cost Management in E-Business Suite versions 12.2.3-12.2.15 contains a high-severity vulnerability (CVSS 8.1) that allows low-privileged users with network access to read, create, delete, or…

How to fix or mitigate CVE-2026-60741?

Within 24 hours: Audit all Oracle E-Business Suite deployments to identify instances running versions 12.2.3 through 12.2.15 and document ownership; restrict network access to the Cost Management module to administrative users only; and enable detailed audit logging of all Cost Management transactions. Within 7 days: Complete a comprehensive inventory of affected systems and assess sensitivity of data within each instance; contact Oracle Support to confirm patch delivery timeline and interim recommendations; and apply initial access restrictions based on business requirements. Within 30 days: Develop and execute an upgrade plan to versions 12.2.16 or later; implement application-level compensating controls including role-based access limits and read-only restrictions for non-administrative users; and establish automated daily audits of Cost Management data modifications.

Oracle Cost Management CVE-2026-60741

EUVD-2026-47077 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-wph6-xq94-xr56

Authentication Bypass Oracle Cost Management

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reach with low complexity and a required low-privilege account (PR:L, not PR:N given the CVSS vector); high confidentiality and integrity data impact, no availability effect (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:08 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Cost Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Cost Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Compromise of Oracle Cost Management (Internal Operations component) in Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read, create, delete, or modify all data accessible to the module, resulting in high confidentiality and integrity impact but no availability impact. The flaw is rated easily exploitable (CVSS 3.1 8.1, PR:L) and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Cost Management is an inventory/costing module within the Oracle E-Business Suite (EBS) ERP platform, exposed through the web/HTTP tier of the suite (the affected 12.2.x line runs on the Oracle Application Framework and WebLogic-based application services). The vulnerable 'Internal Operations' component handles cost and inventory transactions, so the impacted data is business-critical financial and operational records. No CWE was assigned by NVD, so the precise root-cause class is unconfirmed; however, the vendor's own 'Authentication Bypass' tag combined with a C:H/I:H impact profile is consistent with a broken access-control or authorization weakness (e.g., CWE-284/CWE-862-style missing or improper authorization on an EBS servlet/endpoint) that lets an authenticated user reach data outside their intended scope.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor's designated fix for CVE-2026-60741 across EBS 12.2.3-12.2.15 - patch available per vendor advisory, though no single standalone fix version was published in the input beyond the CPU bundle, so identify the exact EBS patch number for your release from the CPU advisory before deployment. As compensating controls until the CPU is applied, restrict network reachability of the affected Cost Management/Internal Operations pages to trusted internal segments (avoid exposing EBS directly to the internet), tighten which application responsibilities/roles can reach the module and review low-privilege account provisioning to shrink the pool of accounts that meet the PR:L prerequisite, and enable web-tier logging/WAF rules on the EBS HTTP entry points to detect anomalous access to cost/inventory endpoints; note these controls reduce exposure but do not remove the vulnerability and may disrupt legitimate integrations that call the module remotely.