What is the CVSS score of CVE-2026-60789?

CVE-2026-60789 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Sales Offline are affected by CVE-2026-60789?

Oracle Sales Offline (E-Business Suite versions 12.2.3-12.2.15) contains a critical account takeover vulnerability (CVSS 8.8) allowing any authenticated user to fully compromise the application and…

How to fix or mitigate CVE-2026-60789?

Within 24 hours, identify all systems running Oracle E-Business Suite versions 12.2.3 through 12.2.15 and assess the number of active users to evaluate exposure risk. Within 7 days, obtain Oracle's July 2026 Critical Patch Update, test it in a non-production environment, and schedule deployment during a maintenance window to minimize business impact. Complete patch deployment to all production and non-production systems within 30 days, then conduct post-patch validation and access logging review to ensure no unauthorized account activity occurred during the vulnerability window.

Oracle Sales Offline CVE-2026-60789

EUVD-2026-47106 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-v6rm-hp43-8f25

Authentication Bypass Oracle Sales Offline

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reachable (AV:N) with low complexity and no interaction, but a low-privileged EBS account is required (PR:L); full module takeover gives C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:21 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Offline. Successful attacks of this vulnerability can result in takeover of Oracle Sales Offline. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle Sales Offline, a module of Oracle E-Business Suite (Internal Operations component) versions 12.2.3 through 12.2.15, lets a low-privileged authenticated attacker with HTTP network access fully compromise the product. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, describing it as 'easily exploitable' and resulting in complete takeover. No public exploit identified at time of analysis and it is not listed in CISA KEV, but its inclusion in Oracle's July 2026 Critical Patch Update warrants prompt patching.

Technical ContextAI

Oracle Sales Offline is a mobile/disconnected sales application shipped as part of Oracle E-Business Suite (EBS), Oracle's flagship on-premises ERP/CRM suite. The affected component is 'Internal Operations,' and the 12.2.x version line indicates the modern EBS 12.2 release family. Oracle did not assign a CWE (CWE: N/A) and does not publish root-cause detail in its Critical Patch Update advisories, so the exact weakness class is undisclosed; the description's 'takeover' language combined with full C/I/A impact is consistent with an authentication/authorization or injection-class flaw that escalates a low-privileged EBS user to control of the module. The vendor-supplied tag 'Information Disclosure' hints at a confidentiality element, though the CVSS I:H/A:H metrics indicate impact beyond mere disclosure.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update, which addresses this CVE: Patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html - Oracle CPU advisories bundle per-version patches rather than naming a single fix version, so consult the CPU's EBS patch matrix for the exact patch corresponding to your 12.2.x level and apply it during your next maintenance window. Because exploitation requires a low-privileged authenticated account, interim compensating controls include restricting network reachability of the Oracle Sales Offline module to trusted internal segments or VPN only, tightening EBS account provisioning and disabling unused/dormant low-privilege accounts, and monitoring EBS access logs for anomalous requests to the Internal Operations component; note these controls reduce but do not eliminate risk from any legitimate internal user and may impede remote/mobile sales workflows the module is designed to serve.