What is the CVSS score of CVE-2026-60848?

CVE-2026-60848 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Project Contracts are affected by CVE-2026-60848?

Oracle Project Contracts (E-Business Suite versions 12.2.3-12.2.15) contains a vulnerability allowing low-privileged authenticated users to access and modify all project and contract data across the…

How to fix or mitigate CVE-2026-60848?

Within 24 hours, identify all instances of Oracle E-Business Suite running Oracle Project Contracts module versions 12.2.3 through 12.2.15 and enable comprehensive audit logging for all module access. Within 7 days, conduct a complete access review of all user accounts with Project Contracts permissions; revoke unnecessary access; reset credentials for all privileged accounts; and implement network-level firewall restrictions to limit Project Contracts module connectivity to essential users and systems only. Within 30 days, monitor Oracle security advisories for CVE-2026-60848 patch availability and plan migration to patched versions; deploy enhanced application-level monitoring to detect unauthorized data access and modifications; and implement real-time alerting for suspicious Project Contracts activity.

Oracle Project Contracts CVE-2026-60848

EUVD-2026-47147 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-73pm-r9g5-gqmf

Authentication Bypass Oracle Project Contracts

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reach, low complexity, no UI; a low-privileged EBS account is required (PR:L); full data read and modify give C:H/I:H with no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:46 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Contracts. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Contracts accessible data as well as unauthorized access to critical data or complete access to all Oracle Project Contracts accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Project Contracts (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the module. Rated CVSS 3.1 8.1 (C:H/I:H, no availability impact), it is described by Oracle as easily exploitable and requires only authenticated network access. No public exploit has been identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Project Contracts is a module within the Oracle E-Business Suite (EBS) ERP platform, running on the EBS web/application tier (Oracle Application Server / WebLogic front-ending a database) and reached over HTTP. The affected component is 'Internal Operations.' Oracle did not assign a CWE (listed as N/A), but the impact profile - full read plus create/delete/modify of module-accessible data by a low-privileged user - is consistent with a broken access control or authorization flaw (missing function- or object-level authorization) that lets an authenticated user act beyond their intended privilege scope. The 'Authentication Bypass' tag in the intelligence feed conflicts with the CVSS PR:L metric (which indicates some authentication is required); absent an explicit Oracle statement, treat this as an authorization/privilege-escalation issue rather than a true pre-auth bypass.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships EBS security fixes as cumulative CPU patches per version rather than a single named release, so identify and apply the specific Project Contracts / EBS 12.2 patch listed in that CPU for your installed release (Patch status: patch available per vendor advisory - no independently confirmed standalone fix version). As compensating controls until patched, restrict network reachability of the EBS web tier so the Project Contracts / OA Framework endpoints are not internet-exposed (place behind VPN or IP allow-listing), tighten application responsibilities and menus so only users who genuinely need Project Contracts hold access (shrinking the pool of low-privileged accounts that satisfy the PR:L precondition), and increase monitoring of EBS access logs for anomalous Project Contracts data operations. Trade-offs: restricting responsibilities may disrupt legitimate contract-management workflows and network restrictions may affect remote or partner access, so validate each control against business requirements.