What is the CVSS score of CVE-2026-60788?

CVE-2026-60788 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.4%.

Which versions of Oracle Sales Offline are affected by CVE-2026-60788?

Oracle Sales Offline (E-Business Suite Internal Operations) versions 12.2.3-12.2.15 contain a high-severity vulnerability enabling authenticated, low-privileged attackers to read, modify, delete, or…

How to fix or mitigate CVE-2026-60788?

Within 24 hours, inventory all systems running Oracle E-Business Suite versions 12.2.3 through 12.2.15 and identify which handle financial, customer, or operational data; contact Oracle support to confirm patch availability for your deployment versions. Within 7 days, implement network-layer compensating controls: restrict HTTP access to Sales Offline to internal IP ranges and authenticated-user-only access, deploy web application firewall rules to detect suspicious data-access patterns, and enable database audit logging on all Sales Offline instances to record read and write operations. Within 30 days, execute a comprehensive mitigation strategy including air-gapping affected systems from external networks if possible, establishing monitoring alerts for unauthorized data modifications, and planning a technology refresh or version upgrade timeline with Oracle support; escalate to change advisory board if system is business-critical.

Oracle Sales Offline CVE-2026-60788

EUVD-2026-47105 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-4xx2-27pp-59cr

Authentication Bypass Denial Of Service Oracle Sales Offline

8.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.3 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

vuln.today AI

8.3 HIGH

Network HTTP reachable and easily exploitable (AV:N/AC:L) but needs a valid low-privilege EBS account (PR:L); full data read/write (C:H/I:H) with only partial DoS (A:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:21 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.3

DescriptionCVE.org

Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Offline. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Sales Offline accessible data as well as unauthorized access to critical data or complete access to all Oracle Sales Offline accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Sales Offline. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).

AnalysisAI

Broad data compromise in Oracle Sales Offline (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read, create, delete, or modify all data the application can access and cause a partial denial of service over HTTP. Oracle rates it CVSS 3.1 8.3 (C:H/I:H/A:L) and describes it as easily exploitable, disclosed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a strong patching priority.

Technical ContextAI

Oracle Sales Offline is a module of the Oracle E-Business Suite (EBS) 12.2 application platform, which runs on Oracle Application Server/WebLogic with an Oracle Database backend and is accessed as a web application over HTTP. The flaw sits in the 'Internal Operations' component. No CWE was assigned by NVD, so the exact root-cause class is not formally categorized; the combination of full confidentiality and integrity impact with only partial availability impact and an unchanged scope (S:U) is consistent with a broken-access-control or injection weakness that lets an already-authenticated low-privilege user reach data and operations beyond their intended authorization boundary within the same application. The 12.2.3-12.2.15 range corresponds to the EBS 12.2 release train and its cumulative Application Update packs.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle distributes EBS security fixes as CPU patches keyed to your exact 12.2.x Application Update pack level rather than as a single named release, so identify your current 12.2.3-12.2.15 level and apply the corresponding July 2026 CPU patch - no specific fixed version number was provided in the input, so consult the CPU patch matrix for the exact patch ID. Until patched, reduce exposure by restricting network access to the EBS/Sales Offline HTTP endpoints to trusted internal networks or VPN only, tightening application role/responsibility assignments so low-privilege accounts cannot reach Internal Operations functions, and monitoring for unexpected data creation, modification, or deletion; note these controls reduce reachability but do not remove the underlying flaw and may impede legitimate remote or partner users of the offline sales workflow.