What is the CVSS score of CVE-2026-60799?

CVE-2026-60799 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60799?

Oracle E-Business Suite's Compensation Workbench (versions 12.2.3-12.2.15) contains a data access flaw allowing authenticated users to read and modify employee compensation records beyond their…

How to fix or mitigate CVE-2026-60799?

Within 24 hours, inventory all Oracle E-Business Suite instances and confirm which run Compensation Workbench in versions 12.2.3 through 12.2.15. Within 7 days, restrict module access to personnel with documented business need, enable detailed audit logging for all compensation data access and modifications, and establish monitoring for anomalous queries or changes. Within 30 days, contact Oracle to determine available remediation paths; prioritize upgrading affected systems to versions outside the vulnerable range (12.2.16 or later, or 12.2.2 or earlier) or implement the patch once Oracle releases it.

Oracle E-Business Suite CVE-2026-60799

EUVD-2026-47111 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-j3xw-3fjq-fcc6

Authentication Bypass Oracle E Business Suite

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Network HTTP-reachable component exploitable by any authenticated low-privilege user (PR:L, AC:L); full read of module data (C:H) but only partial write (I:L) and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:07 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle Compensation Workbench product of Oracle E-Business Suite (component: Compensation Workbench). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Compensation Workbench. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Compensation Workbench accessible data as well as unauthorized update, insert or delete access to some of Oracle Compensation Workbench accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).

AnalysisAI

Unauthorized data access in Oracle E-Business Suite's Compensation Workbench component (versions 12.2.3 through 12.2.15) allows a low-privileged, authenticated attacker with HTTP network access to read all data accessible to the module and to modify some of it. Oracle rates this CVSS 7.1 (C:H/I:L). No public exploit is identified at time of analysis and it is not listed in CISA KEV, though it was disclosed in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Compensation Workbench is a module within Oracle E-Business Suite (EBS) Human Resources / Human Capital Management, used to manage salary planning, bonus allocation, and compensation review cycles. The vulnerability lies in the web-facing (HTTP) tier of this component, which runs on the Oracle Application Server / WebLogic stack fronting the EBS 12.2 code line. Oracle did not assign a CWE (listed as N/A); the CVSS profile (network vector, low privileges, high confidentiality with partial integrity impact and no availability impact) combined with the vendor's 'Authentication Bypass' tag is consistent with a broken access-control / authorization weakness (CWE-284/CWE-863 class) that lets a legitimate low-privilege user reach data and functions beyond their intended authorization scope.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update, documented at https://www.oracle.com/security-alerts/cpujul2026.html - Patch available per vendor advisory, though no discrete fix build number is given in the source data, so consult the CPU patch matrix for the exact patch matching your EBS 12.2.x level. Until the CPU patch is applied, reduce exposure by ensuring the EBS instance and Compensation Workbench pages are not reachable from the public internet (restrict to VPN/internal network via reverse-proxy or firewall rules, which may disrupt legitimate remote HR users), tighten role/responsibility assignments so only necessary users hold access to the compensation module (may block valid workflows), and increase auditing/monitoring of compensation data access; these controls limit reachability but do not remove the underlying authorization flaw.