What is the CVSS score of CVE-2026-60749?

CVE-2026-60749 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Assets are affected by CVE-2026-60749?

Oracle Assets in E-Business Suite versions 12.2.3-12.2.15 contains a vulnerability allowing authenticated users with low privileges to read, create, delete, or modify asset records.

How to fix or mitigate CVE-2026-60749?

Within 24 hours, identify all Oracle E-Business Suite 12.2.x instances in your environment and confirm which run versions 12.2.3-12.2.15 with Oracle Assets enabled; document current user access levels and roles. Within 7 days, implement interim controls: restrict network access to Oracle Assets modules via firewall rules and limit to essential business users, enforce role-based access control at the application layer to minimize low-privileged user data access, and enable comprehensive audit logging for all asset record transactions. Within 30 days, engage Oracle support to determine patch timeline and interim workaround options; prioritize testing and deployment of any vendor patch once released, or evaluate upgrade paths to Oracle E-Business Suite versions beyond 12.2.15.

Oracle Assets CVE-2026-60749

EUVD-2026-47080 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-329m-vvpj-fw65

Authentication Bypass Oracle E Business Suite

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP access with a valid low-privilege account gives PR:L/AV:N/AC:L; unauthorized read and modify of asset data yield C:H/I:H, with no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:07 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Assets product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Assets. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Assets accessible data as well as unauthorized access to critical data or complete access to all Oracle Assets accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Assets (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all Oracle Assets-accessible data. The CVSS 3.1 base score is 8.1 with high confidentiality and integrity impact but no availability impact, reflecting a data-integrity and disclosure risk rather than a service outage. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Assets is the fixed-asset lifecycle management module within Oracle E-Business Suite (EBS), a large web-based ERP platform typically fronted by Oracle Application Server / WebLogic and accessed over HTTP. The affected 'Internal Operations' component handles server-side asset processing logic. No CWE was assigned by NVD, so the exact weakness class is not formally categorized; however, the vendor's 'Authentication Bypass' tag combined with a PR:L vector and high confidentiality/integrity impact is consistent with a broken access control or authorization flaw where an authenticated low-privilege user can reach data or operations beyond their intended scope. The affected version band (12.2.3-12.2.15) corresponds to the Oracle EBS 12.2 release line.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Patch available per vendor advisory, though the input does not specify an exact patched build number, so identify the correct patch for your 12.2.x level directly from the CPU matrix. Because Oracle CPU patches must be applied cumulatively, ensure your EBS instance is at a supported baseline before patching. As compensating controls until patched: restrict network access to the EBS HTTP tier so only trusted internal users and segments can reach it (reduces the attacker pool but does not stop malicious insiders or compromised accounts), tighten Oracle Assets responsibility/role assignments to enforce least privilege and limit which authenticated users can reach Internal Operations functions, and increase auditing/monitoring on Oracle Assets data changes to detect unauthorized creation, modification, or deletion. These controls narrow exposure but do not remediate the underlying flaw.