What is the CVSS score of CVE-2026-60836?

CVE-2026-60836 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60836?

Oracle E-Business Suite HCM module (versions 12.2.3-12.2.15) is vulnerable to administrative account takeover, allowing attackers with existing high-privilege access to compromise confidentiality,…

How to fix or mitigate CVE-2026-60836?

Within 24 hours: inventory all Oracle EBS deployments running versions 12.2.3-12.2.15 and confirm whether the HCM Common Architecture module is active; identify all high-privilege accounts with module access and review their recent activity logs for anomalies. Within 7 days: implement network access controls restricting HTTP connectivity to the HCM module to essential personnel and systems only; enable enhanced logging and alerting on all privileged account access; contact Oracle support to request interim mitigation guidance and confirmed patch availability timeline. Within 30 days: evaluate upgrade path to EBS 12.2.16 or later, or newer EBS releases; deploy vendor patch immediately upon release; document all compensating controls implemented during the interim period.

Oracle E-Business Suite CVE-2026-60836

EUVD-2026-47137 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-c3rp-chff-6w23

Privilege Escalation Oracle Hcm Common Architecture

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network HTTP access with low complexity, but requires pre-existing high application privileges (PR:H); full module takeover yields C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:53 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture. Successful attacks of this vulnerability can result in takeover of Oracle HCM Common Architecture. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of the Oracle HCM Common Architecture module (Internal Operations component) within Oracle E-Business Suite is possible, allowing an attacker who already holds high-level application privileges to take over the module over the network via HTTP. The flaw affects EBS releases 12.2.3 through 12.2.15 and carries a CVSS 3.1 score of 7.2 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' for an authenticated actor.

Technical ContextAI

Oracle HCM (Human Capital Management) Common Architecture is a shared framework layer inside Oracle E-Business Suite 12.2, the on-premise ERP/HR application stack that runs on Oracle WebLogic/Application Server fronted by HTTP. The affected 'Internal Operations' component handles back-end HCM processing shared across HR modules. Oracle did not assign a CWE (CWE: N/A) and the advisory does not disclose the root-cause class; the vendor tag 'Information Disclosure' hints at a confidentiality-affecting defect, though the CVSS vector shows full C/I/A impact indicating a broader takeover rather than pure disclosure. Because EBS 12.2 is a monolithic, session-authenticated web application, exploitation is reached through authenticated HTTP requests to the application tier.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); this is Patch available per vendor advisory, though the input does not enumerate a specific patched build number, so identify the exact patch for your EBS 12.2.x level from that CPU. Oracle strongly recommends applying CPUs promptly and running only supported EBS versions. As compensating controls until patched, restrict network reach to the EBS application tier so only trusted internal hosts can send HTTP requests to the HCM/Internal Operations endpoints, and tighten authorization so that high-privilege application accounts (the PR:H prerequisite) are minimized, closely audited, and protected with strong/MFA-backed authentication - this reduces the pool of accounts able to trigger the flaw, at the cost of administrative overhead. Review application access logs for anomalous privileged activity against HCM modules.