What is the CVSS score of CVE-2026-60764?

CVE-2026-60764 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60764?

Oracle E-Business Suite versions 12.2.3-12.2.15 contain an authentication bypass vulnerability in the Financials Common Modules that allows low-privileged network-authenticated users to read, modify,…

How to fix or mitigate CVE-2026-60764?

Within 24 hours: Identify all Oracle E-Business Suite instances running Financials Common Modules (versions 12.2.3-12.2.15) and restrict network access to these modules to verified internal networks only; disable or proxy direct HTTP access. Within 7 days: Deploy database-level monitoring and alerting for all modifications to financial tables; perform forensic audit of recent transaction logs for unauthorized access or data changes; apply database access controls limiting module-accessing accounts to minimum necessary privileges. Within 30 days: Plan and execute upgrade to Oracle E-Business Suite 12.2.16 or later; contact Oracle Support to confirm patch availability and upgrade timeline.

Oracle E-Business Suite CVE-2026-60764

EUVD-2026-47088 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-252p-8cmc-m6f2

Authentication Bypass Oracle E Business Suite

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reachable with low-complexity attack by an authenticated low-privilege EBS user (PR:L); high confidentiality and integrity data impact, no availability effect (A:N), scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:06 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Components). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financials Common Modules. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financials Common Modules accessible data as well as unauthorized access to critical data or complete access to all Oracle Financials Common Modules accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Financials Common Modules (Common Components) within Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. Oracle rates it CVSS 3.1 8.1 (high confidentiality and integrity impact, no availability impact) and tags it as an authentication-bypass-class issue. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Financials Common Modules is a shared services layer within the Oracle E-Business Suite (EBS) Applications stack, providing common financial data structures and services consumed by multiple EBS Financials products. The vulnerable 'Common Components' subcomponent is reached over HTTP through the EBS web tier, which fronts Oracle Application Server / WebLogic and the underlying database. Oracle did not assign a CWE (CWE: N/A), but the 'Authentication Bypass' tag combined with a CVSS profile of C:H/I:H and PR:L points to a broken-access-control or authorization-bypass class defect: a user who legitimately holds a low-privileged application account can reach data and operations that should require higher privilege. Because EBS modules share a common data model, a flaw in a Common Modules component can expose data belonging to many downstream Financials functions.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update (CPU) as documented at https://www.oracle.com/security-alerts/cpujul2026.html, which is the vendor-released fix channel for this issue across EBS 12.2.3-12.2.15; the input does not specify a single exact patched build number, so identify the correct patch for your specific 12.2.x level from that advisory (Patch available per vendor advisory). Because EBS CPU patching requires downtime and testing, interim compensating controls should be considered: restrict the EBS web tier so the Financials Common Modules endpoints are not reachable from untrusted networks or the internet (front with a reverse proxy / WAF and network ACLs), tighten application role and responsibility assignments to reduce the population of low-privileged accounts that can reach the affected component, and increase auditing/monitoring of Financials data access and modification. These controls reduce exposure but do not remove the underlying flaw and may disrupt legitimate low-privilege workflows, so they are stopgaps until the CPU is applied.