What is the CVSS score of CVE-2026-60844?

CVE-2026-60844 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60844?

Oracle E-Business Suite Customer Support module (versions 12.2.3-12.2.15) contains a significant data access vulnerability (CVE-2026-60844) enabling authenticated low-privileged users to read and…

How to fix or mitigate CVE-2026-60844?

Within 24 hours, identify all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15 with Customer Support module active, and assess direct exposure to untrusted networks. Within 7 days, obtain Oracle's July 2026 Critical Patch Update and validate it in a staging environment that mirrors your production configuration, including any custom modifications or integrations. Within 30 days, deploy the July 2026 CPUs to all affected production Oracle E-Business Suite systems, prioritizing those processing the highest volumes of sensitive customer data.

Oracle E-Business Suite CVE-2026-60844

EUVD-2026-47143 HIGH

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-466f-3hmj-3pq6

Authentication Bypass Information Disclosure Oracle Customer Support

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reach with low complexity and no user interaction, but a valid low-privileged EBS account is required (PR:L); high confidentiality and integrity impact, no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:51 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Customer Support product of Oracle E-Business Suite (component: Update Service Request). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Customer Support. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Customer Support accessible data as well as unauthorized access to critical data or complete access to all Oracle Customer Support accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Elevated data compromise in Oracle E-Business Suite's Customer Support module (Update Service Request component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read and modify all Customer Support-accessible data. The flaw carries high confidentiality and integrity impact (CVSS 8.1) but no availability impact, and Oracle rates it easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; remediation is delivered via Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle E-Business Suite is Oracle's flagship on-premises ERP suite; the affected surface is the Customer Support (TeleService/Service Request) application, specifically the 'Update Service Request' functionality exposed over HTTP through the EBS web tier. The CWE is listed as N/A by the source, so the exact weakness class is not formally categorized, but the CVSS profile (network HTTP, low complexity, low privilege, no user interaction, high C and I with no A) combined with the vendor tag 'Authentication Bypass' points to a broken access-control or authorization flaw in the Service Request update path - an authenticated but low-privileged EBS user is able to reach and alter Service Request data beyond their intended authorization boundary. All 12.2.x releases in the 12.2.3-12.2.15 band share this component code, indicating a long-standing defect in the EBS 12.2 code line rather than a single-release regression.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the authoritative source for the exact patch/bundle for each affected 12.2.x level - cite that advisory rather than an invented version number, as no discrete fix version was included in the input. Patch available per vendor advisory; the specific patched build was not independently confirmed in this dataset. As compensating controls until the CPU is applied, restrict network access to the EBS web tier so the Service Request update endpoints are reachable only from trusted internal networks or via VPN, tighten EBS responsibilities/roles so low-privileged accounts cannot reach Customer Support Service Request functions they don't require (least privilege), and monitor application and web logs for anomalous Service Request create/delete/modify activity. Trade-offs: network restriction can break legitimate remote or partner access to the support portal, and role tightening may disrupt users who legitimately use Service Request updates, so validate against business workflows before enforcing.