What is the CVSS score of CVE-2026-60755?

CVE-2026-60755 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Assets are affected by CVE-2026-60755?

Oracle Assets (E-Business Suite internal operations component) faces a HIGH-severity vulnerability (CVE-2026-60755) enabling complete system compromise for high-privileged attackers; no public…

How to fix or mitigate CVE-2026-60755?

Within 24 hours: inventory all Oracle Assets systems running versions 12.2.3-12.2.15, audit high-privileged account assignments and access patterns, and enable comprehensive security logging on all Assets database and application components. Within 7 days: implement network-level access restrictions limiting Oracle Assets access to essential personnel only, deploy monitoring for suspicious privilege escalation or unauthorized database activity, and establish incident response procedures for this vulnerability. Within 30 days: monitor Oracle Critical Patch Update communications for a released fix, develop a phased upgrade plan for affected systems, and conduct a security hardening assessment of Oracle Assets configuration to reduce exploitation surface.

Oracle Assets CVE-2026-60755

EUVD-2026-47082 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-9c63-8mmc-w58j

Authentication Bypass Oracle E Business Suite

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network HTTP reachability with low complexity but requiring a high-privilege EBS account (PR:H), unchanged scope, and full application compromise across C/I/A.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:07 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Assets product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Assets. Successful attacks of this vulnerability can result in takeover of Oracle Assets. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Assets (part of Oracle E-Business Suite, Internal Operations component) is achievable by a high-privileged, network-adjacent attacker over HTTP, per the Oracle July 2026 Critical Patch Update. With a CVSS 3.1 base score of 7.2 (C:H/I:H/A:H) and no user interaction required, successful exploitation results in complete takeover of Oracle Assets across supported releases 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Assets is the fixed-asset accounting module within Oracle E-Business Suite (EBS), a large ERP suite typically deployed as an internet- or intranet-facing web application stack (Oracle HTTP Server / WebLogic front end over an Oracle Database back end). The flaw resides in the 'Internal Operations' component and is reachable via HTTP. No CWE was assigned by Oracle or NVD, so the precise weakness class (e.g., injection, improper authorization, or deserialization) cannot be determined from the available data; Oracle's Critical Patch Update advisories characteristically omit technical root-cause detail. The CVSS scope is Unchanged (S:U), indicating the impact is confined to the Oracle Assets application authorization boundary rather than crossing into the underlying host or other components.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html); Oracle does not publish a discrete fixed version number for EBS modules, so identify the specific patch for your EBS 12.2 release level from the CPU patch matrix and My Oracle Support. No standalone fix version is independently confirmed in the available data. As compensating controls until patching, tighten access to the Oracle Assets Internal Operations functionality by restricting which users hold high-privilege EBS responsibilities (the exploit requires PR:H), place the EBS web tier behind a VPN or reverse proxy so it is not internet-reachable, and enforce network ACLs limiting HTTP access to the application to trusted management segments; the trade-off is reduced remote administrative convenience and possible disruption to legitimate privileged workflows if responsibilities are over-restricted.