What is the CVSS score of CVE-2026-60806?

CVE-2026-60806 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Cost Management are affected by CVE-2026-60806?

CVE-2026-60806 affects Oracle Cost Management within E-Business Suite (versions 12.2.3-12.2.15), enabling low-privileged attackers to fully compromise the costing module's confidentiality, integrity,…

How to fix or mitigate CVE-2026-60806?

Within 24 hours, identify all Oracle E-Business Suite deployments running versions 12.2.3 through 12.2.15 and confirm which systems host the Costing module. Within 7 days, implement network segmentation to restrict HTTP access to the Costing module to authorized users only, enforce strong authentication for cost management functions, and enable detailed audit logging of all costing transaction access and modifications. Within 30 days, engage Oracle Support to determine timelines for a security fix and evaluate feasibility of upgrading to an unaffected EBS release; simultaneously deploy enhanced monitoring for anomalous cost data changes and unauthorized module access attempts.

Oracle Cost Management CVE-2026-60806

EUVD-2026-47117 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-4v9q-5fxh-7fph

Authentication Bypass Oracle Cost Management

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

HTTP-reachable web tier gives AV:N; requires a valid low-privilege EBS login (PR:L) and difficult preconditions (AC:H); full module takeover yields C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:07 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Costing Transaction Errors). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Takeover of Oracle Cost Management, the costing module of Oracle E-Business Suite (component: Costing Transaction Errors), is achievable by a low-privileged attacker with HTTP network access. Successful exploitation yields full confidentiality, integrity, and availability compromise of the module across EBS releases 12.2.3 through 12.2.15. Rated CVSS 3.1 7.5 but explicitly difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not on the CISA KEV list.

Technical ContextAI

Oracle E-Business Suite is Oracle's on-premises ERP suite, and Cost Management is the module responsible for inventory and manufacturing cost accounting; the affected code path is its 'Costing Transaction Errors' component. EBS 12.2.x runs as a web-tier application (Oracle Application Server / WebLogic front end over an Oracle database) reachable over HTTP, which is why the vector is AV:N. Oracle assigned no CWE (CWE: N/A) and the advisory does not disclose the weakness class, so the exact root cause (e.g. injection, access-control bypass, or deserialization) cannot be stated from the available data; the phrase 'takeover of Oracle Cost Management' indicates the flaw grants full control of the module rather than a single data leak, despite the vendor's 'Information Disclosure' tag.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update, which contains the fix; patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html - the input does not list a discrete fix build number, so identify the exact 12.2.x patch for your release from that CPU. Because exploitation requires a low-privileged authenticated account, until patching completes reduce risk by tightening EBS user provisioning and revoking unnecessary accounts, restricting network reachability of the EBS web tier to trusted internal networks or VPN instead of the public internet, and placing a WAF or reverse proxy in front of the Costing Transaction Errors functionality; these are compensating controls only - they raise an already-high bar (AC:H) but do not remove the flaw, and over-restricting access may disrupt legitimate costing users.