What is the CVSS score of CVE-2026-60790?

CVE-2026-60790 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Sales Offline are affected by CVE-2026-60790?

Oracle E-Business Suite versions 12.2.3-12.2.15 contain a high-severity vulnerability enabling complete compromise of the Sales Offline module with cascade impact to interconnected business systems.

How to fix or mitigate CVE-2026-60790?

Within 24 hours, identify and inventory all Oracle E-Business Suite systems running versions 12.2.3-12.2.15, particularly those exposing the Internal Operations component over HTTP; within 7 days, restrict network access to the Internal Operations component to authorized administrative personnel only and implement comprehensive audit logging and alerting; within 30 days, execute an upgrade plan to versions beyond 12.2.15, or establish persistent network segmentation and stricter access controls as a long-term compensating strategy.

Oracle Sales Offline CVE-2026-60790

EUVD-2026-47107 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-5hmw-rx39-4f78

Authentication Bypass Oracle Sales Offline

8.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.0 HIGH

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Network HTTP reach gives AV:N; 'difficult to exploit' supports AC:H; high-privilege prerequisite forces PR:H; documented cross-product impact and full takeover justify S:C with C/I/A:H.

3.1 AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:08 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.0

DescriptionCVE.org

Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Sales Offline. While the vulnerability is in Oracle Sales Offline, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Sales Offline. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Sales Offline (a module of Oracle E-Business Suite 12.2.3 through 12.2.15) is possible for an already high-privileged attacker who reaches the Internal Operations component over HTTP, and because the flaw carries a scope change (S:C) a successful attack can significantly impact additional products beyond Sales Offline itself. The issue is rated CVSS 3.1 8.0 but Oracle characterizes it as difficult to exploit (AC:H) and requiring elevated privileges (PR:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Sales Offline is a field-sales disconnected/synchronization module within Oracle E-Business Suite (EBS), Oracle's large integrated ERP/CRM application stack; the affected code path is the Internal Operations component reached via HTTP through the EBS web tier. No CWE was assigned in the source data, so the precise root-cause class (e.g., injection, deserialization, access-control) cannot be stated with certainty. The most security-relevant technical property is the CVSS scope change (S:C): the vulnerable component and the impacted security authority differ, meaning exploitation can pivot from Sales Offline into other EBS products or shared backend resources, consistent with the description's note that attacks 'may significantly impact additional products.'

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update as documented at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle distributes EBS security fixes as CPU patches rather than a single renamed release, so identify the specific 12.2.x patch for your installed level (12.2.3-12.2.15) from that advisory - treat this as 'Patch available per vendor advisory' since no standalone fix version string was provided in the input. Until patched, reduce exposure by restricting network reachability of the EBS web tier and the Sales Offline / Internal Operations endpoints to trusted internal networks (side effect: may disrupt legitimate remote or field-sales sync users), tightening the assignment of high-privilege EBS responsibilities and accounts since PR:H is required (side effect: administrative overhead and possible workflow friction), and increasing monitoring/audit of privileged EBS activity. If Sales Offline is not used in your deployment, consider disabling or removing the module to eliminate the attack surface.