What is the CVSS score of CVE-2026-60785?

CVE-2026-60785 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Ireceivables are affected by CVE-2026-60785?

Oracle iReceivables within E-Business Suite releases 12.2.3-12.2.15 is vulnerable to unauthenticated remote compromise, enabling complete system takeover and unauthorized access to sensitive…

How to fix or mitigate CVE-2026-60785?

Within 24 hours, identify all Oracle EBS systems running releases 12.2.3-12.2.15 and assess network accessibility of the iReceivables module (AR Web Utilities component). Immediately implement firewall rules restricting HTTP/HTTPS access to iReceivables to trusted internal networks only, and document all affected systems. Within 7 days, deploy Web Application Firewall rules to block exploit attempts against the AR Web Utilities component, enable comprehensive access logging with real-time SIEM alerts for anomalous activity, and evaluate operational feasibility of temporary module disablement in non-critical environments. Monitor Oracle's Critical Patch Update channel for patch availability; upon release, establish expedited change management procedures to deploy patches to all production systems within 30 days, after validation in non-production environments.

Ireceivables CVE-2026-60785

EUVD-2026-47102 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-2446-395m-wmjx

Authentication Bypass Oracle Ireceivables

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:23 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle iReceivables product of Oracle E-Business Suite (component: AR Web Utilities). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iReceivables. Successful attacks of this vulnerability can result in takeover of Oracle iReceivables. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle iReceivables (a self-service receivables module of Oracle E-Business Suite, AR Web Utilities component) is possible by a remote unauthenticated attacker over HTTP, affecting EBS releases 12.2.3 through 12.2.15. Successful exploitation yields complete takeover with high confidentiality, integrity, and availability impact, though the CVSS vector rates exploitation as high-complexity. Addressed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.