What is the CVSS score of CVE-2026-60787?

CVE-2026-60787 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Receivables are affected by CVE-2026-60787?

Oracle Receivables (E-Business Suite versions 12.2.3-12.2.15) contains a high-severity vulnerability enabling full module compromise by high-privilege authenticated users; no public exploit…

How to fix or mitigate CVE-2026-60787?

Within 24 hours, audit all users holding high-privilege access to Oracle Receivables and review transaction logs for suspicious activity on the Internal Operations component. Over the next 7 days, implement enhanced monitoring and alerting on all Receivables module access, enforce multi-factor authentication for all administrative sessions, and restrict network access to the Receivables database from approved systems only. Within 30 days, prioritize and execute an upgrade plan to an unaffected E-Business Suite version and evaluate additional interim controls such as database-layer encryption of sensitive receivables data.

Receivables CVE-2026-60787

EUVD-2026-47104 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-ff64-3f85-738g

Authentication Bypass Oracle Receivables

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:21 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Receivables product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Receivables. Successful attacks of this vulnerability can result in takeover of Oracle Receivables. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Receivables (the accounts-receivable module of Oracle E-Business Suite 12.2.3 through 12.2.15) is possible via the Internal Operations component, where an authenticated attacker holding high privileges can send crafted HTTP requests to take over the module. Oracle rates this CVSS 7.2 with high confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' but exploitation is gated behind existing high-privilege access. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.