What is the CVSS score of CVE-2026-60783?

CVE-2026-60783 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle iReceivables are affected by CVE-2026-60783?

Oracle iReceivables within E-Business Suite AR Web Utilities (versions 12.2.3-12.2.15) contains an account takeover vulnerability enabling full module compromise through low-privileged user accounts.

How to fix or mitigate CVE-2026-60783?

Within 24 hours, inventory all Oracle E-Business Suite instances and identify systems running iReceivables versions 12.2.3-12.2.15; restrict network access to AR Web Utilities to necessary users and implement IP whitelisting for the module. Within 7 days, deploy enhanced monitoring on all AR Web Utilities access and user privilege elevation attempts, segregate the AR Web Utilities component from non-essential systems via network segmentation, and disable or restrict low-privilege AR user accounts where operationally feasible. Within 30 days, establish a remediation plan in coordination with Oracle support (patch availability, version upgrades, or alternative compensating controls), document all compensating measures, and begin planning an upgrade to unaffected iReceivables versions when patches or supported upgrades become available.

Oracle iReceivables CVE-2026-60783

EUVD-2026-47100 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-w292-p893-vg2m

Authentication Bypass Oracle Ireceivables

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote HTTP reachability gives AV:N/AC:L; a low-privilege account is required per Oracle so PR:L; module takeover yields full C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:24 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle iReceivables product of Oracle E-Business Suite (component: AR Web Utilities). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iReceivables. Successful attacks of this vulnerability can result in takeover of Oracle iReceivables. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle iReceivables (Oracle E-Business Suite, AR Web Utilities component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access fully compromise the module. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning a valid low-privilege EBS account is the only real barrier. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and authenticated-but-low privilege requirement make it a strong patching priority.

Technical ContextAI

Oracle iReceivables is a self-service web module of the Oracle E-Business Suite (EBS) financials stack that lets customers view and pay accounts-receivable invoices; the affected code lives in the shared AR (Accounts Receivable) Web Utilities component. The vulnerability is reachable over HTTP against the EBS web tier, consistent with the servlet/JSP-based EBS application architecture. No CWE was assigned by NVD or Oracle (CWE: N/A), so the precise root-cause class is not published; Oracle's 'takeover of Oracle iReceivables' language plus full C/I/A impact points to a flaw that lets a low-privilege user escalate to complete control of the module's data and functions. The tag 'Information Disclosure' hints at a confidentiality-exposure element, though the CVSS vector shows equally high integrity and availability impact.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); patch available per vendor advisory, though no discrete fixed version string was published in the source data, so consult the CPU matrix for the exact patch level for your 12.2.x release. Because exploitation requires only a low-privilege authenticated account, compensating controls until patching completes should include tightly restricting and auditing iReceivables/self-service account provisioning, placing the EBS web tier behind a WAF or reverse proxy that filters requests to the AR Web Utilities endpoints, and limiting network reachability of iReceivables to trusted customer networks or VPN rather than the open internet - noting that network restrictions may break legitimate external self-service customer access and should be validated against business requirements. Review AR/iReceivables audit logs for anomalous access as a detection measure.