What is the CVSS score of CVE-2026-60772?

CVE-2026-60772 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60772?

Oracle E-Business Suite Financials Common Modules (versions 12.2.3-12.2.15) is vulnerable to low-privilege authenticated users who can create, delete, and modify critical financial records, posing…

How to fix or mitigate CVE-2026-60772?

Within 24 hours, identify all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15 and audit current user access to financial modules; enable maximum audit logging for financial record creation, deletion, and modification. Within 7 days, actively monitor Oracle for availability of the July 2026 Critical Patch Update and prepare deployment plan including pre-production testing. Within 30 days, deploy available patches immediately upon release, conduct forensic review of financial data changes for unauthorized modifications, strengthen role-based access controls to enforce principle of least privilege, and implement real-time alerting on financial data changes.

Oracle E-Business Suite CVE-2026-60772

EUVD-2026-47092 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-8c53-2j35-73mw

Authentication Bypass Oracle E Business Suite

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

vuln.today AI

7.1 HIGH

Network HTTP reach and low complexity, but a valid low-privileged EBS account is required (PR:L); high integrity impact on financial data, partial read (C:L), no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:53 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Components). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financials Common Modules. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financials Common Modules accessible data as well as unauthorized read access to a subset of Oracle Financials Common Modules accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).

AnalysisAI

Data tampering in Oracle E-Business Suite's Financials Common Modules (Common Components) lets a low-privileged, network-authenticated attacker perform unauthorized creation, deletion, and modification of critical financial data across all module-accessible records, plus read access to a subset of that data. Affected releases span 12.2.3 through 12.2.15, remediated in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, though the tag 'Authentication Bypass' warrants scrutiny given the authenticated CVSS profile.

Technical ContextAI

Oracle Financials Common Modules is a shared component layer within Oracle E-Business Suite (EBS), the vendor's flagship on-premises ERP suite covering finance, procurement, and supply-chain processes. The flaw resides in the Common Components subcomponent, which is reached over HTTP through the EBS application tier (Oracle Application Server / WebLogic). Oracle does not assign a CWE (listed N/A), but the impact pattern - high integrity impact with low confidentiality impact and no availability impact - is consistent with a broken access-control / authorization weakness (CWE-284/CWE-863 class) where an authenticated user can reach and alter records beyond their intended scope. The vendor-supplied tag 'Authentication Bypass' suggests an authorization-boundary defect rather than a memory-safety bug.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the authoritative source for the exact patch level per EBS 12.2 release; Patch available per vendor advisory, though no discrete fixed version string is enumerated in the input beyond the CPU reference. Because the flaw is reached over HTTP by authenticated users, compensating controls until patching include restricting network access to the EBS application tier (place it behind VPN/allowlist rather than exposing the login or the affected module endpoints to the internet), tightening EBS responsibility/role assignments to minimize which low-privileged accounts can reach Financials Common Modules functionality, and enabling database/application auditing on critical financial tables to detect unauthorized create/delete/modify activity - with the trade-off that access restriction may disrupt legitimate remote or integration users, and auditing adds overhead without preventing the action. Verify the 'Authentication Bypass' tag with Oracle support, since it may indicate exposure broader than the PR:L vector implies.