What is the CVSS score of CVE-2026-60845?

CVE-2026-60845 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of E Business Suite are affected by CVE-2026-60845?

Oracle E-Business Suite versions 12.2.3 through 12.2.15 is vulnerable to full server compromise by existing high-privilege users, creating significant insider-threat risk for organizations dependent…

How to fix or mitigate CVE-2026-60845?

Immediate actions (within 24 hours): Identify all Oracle E-Business Suite systems running versions 12.2.3-12.2.15 and isolate those with MWA components from unnecessary network access; restrict high-privilege account usage to documented business needs only and enable comprehensive logging of all administrative activities. Short-term actions (within 7 days): Contact Oracle Support to confirm patch availability and timeline; review administrative account roles and implement multi-factor authentication on high-privilege accounts; audit the past 30 days of activity logs from all administrative users for suspicious patterns. Long-term actions (within 30 days): Deploy network segmentation to limit lateral movement from compromised high-privilege accounts; establish continuous monitoring for anomalous behavior from administrative accounts; prepare urgent patch application procedures for immediate deployment when the vendor releases a fix.

E Business Suite CVE-2026-60845

EUVD-2026-47144 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-q592-hw9q-pg6v

Authentication Bypass Oracle E Business Suite

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:51 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA General Bugs). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Mobile Application Server. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Application Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full server takeover in Oracle Mobile Application Server (the MWA component of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a high-privileged, network-based attacker to fully compromise the server over HTTP, impacting confidentiality, integrity and availability (CVSS 3.1 base 7.2). Because the attacker must already hold high privileges (PR:H), this is a privilege-escalation-to-takeover issue rather than a pre-auth breach, and there is no public exploit identified at time of analysis nor CISA KEV listing.