What is the CVSS score of CVE-2026-60800?

CVE-2026-60800 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Compensation Workbench are affected by CVE-2026-60800?

Oracle Compensation Workbench (E-Business Suite 12.2.3-12.2.15) contains a vulnerability (CVE-2026-60800) allowing users with network access and system-level credentials to read all employee…

How to fix or mitigate CVE-2026-60800?

Within 24 hours, identify all E-Business Suite 12.2.3-12.2.15 instances running Compensation Workbench and audit access logs for unauthorized activity; immediately implement network-level access restrictions limiting component access to essential system administrators and authorized personnel only. Within 7 days, deploy enhanced audit logging capturing all compensation data access and modifications with real-time alerting, apply least-privilege database access controls to application service accounts, and configure firewall rules to restrict HTTP/HTTPS traffic to authorized sources. Monitor Oracle's security advisories continuously; upon patch release, immediately test in a non-production environment and deploy to production systems within 48 hours of availability.

Oracle Compensation Workbench CVE-2026-60800

EUVD-2026-47112 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-jf6r-pf2v-6gxf

Authentication Bypass Oracle E Business Suite

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Network HTTP reach with low complexity and a required low-privilege EBS account gives AV:N/AC:L/PR:L; full data read is C:H, partial writes I:L, no availability impact A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:07 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle Compensation Workbench product of Oracle E-Business Suite (component: Compensation Workbench). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Compensation Workbench. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Compensation Workbench accessible data as well as unauthorized update, insert or delete access to some of Oracle Compensation Workbench accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).

AnalysisAI

Sensitive data exposure in Oracle Compensation Workbench (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read all data accessible to the component and perform limited unauthorized inserts, updates, or deletes over HTTP. Rated CVSS 7.1 (C:H/I:L/A:N), it was disclosed in the Oracle July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not on CISA KEV, though EBS is a high-value target and Oracle CPU flaws have historically drawn attacker interest.

Technical ContextAI

Compensation Workbench is a module of Oracle E-Business Suite's Human Resources / Advanced Benefits (HRMS) stack, used by enterprises to administer salary, bonus, and stock compensation cycles. It is delivered through the EBS web tier (Oracle Application Framework / Forms served over HTTP/S via Oracle HTTP Server and WebLogic), so the exposed surface is the authenticated EBS self-service/professional UI rather than the database directly. No CWE was assigned by NVD, but the described impact - an authenticated user reaching data beyond their authorization and making limited writes - is consistent with a broken access control / improper authorization weakness (CWE-284/CWE-863 class); the vendor-supplied 'Authentication Bypass' tag more precisely reads as an authorization/privilege boundary bypass given the CVSS PR:L requirement. The affected code is common to the entire 12.2.x line (12.2.3-12.2.15).

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory; Oracle ships these as cumulative EBS 12.2.x patch bundles, so apply the CPU patch level appropriate to your 12.2.3-12.2.15 install rather than a standalone version number (no discrete fixed component version was published in the source data, so confirm the exact patch ID in the CPU matrix). Because exploitation requires an authenticated low-privilege account, compensating controls until patching include restricting network access to the EBS web tier (place it behind VPN/reverse proxy and remove any direct internet exposure of the Compensation Workbench/self-service URLs), tightening EBS responsibility and function-security grants so ordinary users cannot reach Compensation Workbench menus, enforcing strong authentication and reviewing/pruning dormant low-privilege accounts, and increasing audit logging on compensation data access to detect anomalous reads or writes. The access-restriction controls may disrupt legitimate remote HR/self-service users, so scope them to non-privileged paths; none of these substitute for the CPU patch, which is the only true fix.