What is the CVSS score of CVE-2026-60807?

CVE-2026-60807 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Bills of Material are affected by CVE-2026-60807?

Oracle E-Business Suite Bills of Material module (versions 12.2.3-12.2.15) is vulnerable to account takeover via social engineering attacks that grant authenticated, low-privilege users the ability…

How to fix or mitigate CVE-2026-60807?

Within 24 hours, restrict HTTP access to the Bills of Material module in Oracle EBS 12.2.3-12.2.15 to trusted networks only and audit the past 30 days of access logs for indicators of compromise. Within 7 days, segment the affected EBS instances from general network traffic, deploy phishing/social engineering awareness training to all users with BOM access, and enable comprehensive logging on the module. Within 30 days, contact Oracle to confirm patch availability and plan an upgrade to a patched EBS version; if no patch is available within 30 days, implement multi-factor authentication for BOM module access, disable the module if operationally feasible, and deploy intrusion detection signatures to detect exploitation attempts.

Oracle Bills of Material CVE-2026-60807

EUVD-2026-47118 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-4vxv-9cmg-92h5

Authentication Bypass Oracle Bills Of Material

8.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Network HTTP reachable (AV:N) and low-complexity (AC:L), but needs an authenticated low-priv account (PR:L) and a separate victim's interaction (UI:R), yielding full module takeover (C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:06 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.0

DescriptionCVE.org

Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Bills of Material. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).

AnalysisAI

Account/component takeover in Oracle Bills of Material (component: Internal Operations) within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged, authenticated attacker with network HTTP access fully compromise the module when a legitimate user is lured into interacting with attacker-supplied content. Per the CVSS vector (PR:L/UI:R), exploitation requires an existing low-level account plus victim interaction, but a successful attack yields high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.0). No public exploit identified at time of analysis; disclosed via Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Bills of Material is a manufacturing/product-structure module of Oracle E-Business Suite (EBS), a large web-based ERP platform typically fronted by Oracle Application Server / WebLogic and accessed over HTTP. The affected 'Internal Operations' component is reached through the standard EBS web tier. Oracle assigned no CWE (CWE: N/A), and the description does not name a specific weakness class; however, the combination of network HTTP vector, low privilege, and required human interaction from 'a person other than the attacker' is characteristic of a web-application flaw where an authenticated actor plants content or a request that a second, higher-value user then triggers (e.g., stored/reflected injection or cross-user request abuse). Oracle's own tag of 'Information Disclosure' aligns with the high confidentiality impact, though the full C:H/I:H/A:H rating indicates the outcome extends to complete takeover of the module, not disclosure alone.

RemediationAI

Apply the fix delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory; no discrete fixed version number is enumerated in the supplied data - obtain the exact EBS 12.2 patch level from the CPU) at https://www.oracle.com/security-alerts/cpujul2026.html, following Oracle's per-release patch matrix for your 12.2.x level. Until the CPU is applied, reduce exposure by restricting network reachability of the EBS web tier and the Bills of Material / Internal Operations pages to trusted internal networks or VPN, tightening access so only users who genuinely need the module hold accounts (limiting the PR:L prerequisite), and reviewing/hardening least-privilege role assignments; because exploitation needs victim interaction, brief privileged EBS users on not acting on unexpected in-application prompts or links. These access restrictions may impede legitimate remote or partner users of the module, so validate business workflows before enforcing them. Do not defer patching on the assumption controls are sufficient - they only narrow, not remove, the attack surface.