What is the CVSS score of CVE-2026-60852?

CVE-2026-60852 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Lease and Finance Management are affected by CVE-2026-60852?

Oracle Lease and Finance Management deployments (E-Business Suite versions 12.2.3-12.2.15) face a data compromise vulnerability that allows attackers to alter or extract financial records without…

How to fix or mitigate CVE-2026-60852?

Within 24 hours: Identify all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15 and document their financial data scope; immediately restrict network access to the Internal Operations component to authenticated internal users only and disable HTTP access in favor of HTTPS. Within 7 days: Enable comprehensive audit logging with real-time alerting on all data modifications, creations, and deletions in the Lease and Finance Management module; implement network segmentation; conduct forensic review of recent transaction logs for signs of unauthorized changes. Within 30 days: Engage Oracle for patch guidance or upgrade pathways (no vendor-released patch identified at time of analysis); develop and test migration to a remediated version; complete remediation with documented data integrity validation and control owner sign-off.

Oracle Lease and Finance Management CVE-2026-60852

EUVD-2026-47148 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-g698-7rmc-5xjc

Authentication Bypass Oracle Lease And Finance Management

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP access with a valid low-privilege account (PR:L) enables low-complexity read/write to all module data (C:H/I:H); no availability impact and no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:45 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Lease and Finance Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Lease and Finance Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Lease and Finance Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Lease and Finance Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-adjacent attacker to read, create, delete, or modify all application-accessible data over HTTP. The CVSS 3.1 base score is 8.1 (C:H/I:H), reflecting full confidentiality and integrity impact with no availability effect. This CVE was disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Oracle Lease and Finance Management is a module within Oracle E-Business Suite (EBS), Oracle's flagship on-premises ERP/financials platform, running on the Oracle Application Server / WebLogic middle tier over HTTP against an Oracle database backend. The flaw resides in the 'Internal Operations' component and is characterized in the source tags as an 'Authentication Bypass,' though Oracle assigns no CWE (CWE: N/A). Because EBS exposes module functionality through web-based servlets and JSP pages, a bypass of authorization/authentication controls at this layer would grant an already-authenticated low-privilege user access to data and operations beyond their intended role, consistent with the CWE-285/CWE-287 (improper authorization/authentication) class.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships EBS security fixes as consolidated CPU patches per version rather than a single named release, so identify and apply the specific patch listed for your 12.2.x level (12.2.3-12.2.15) - no discrete fix version was provided in the input, so treat 'Patch available per vendor advisory' as the status and consult the CPU patch matrix for the exact patch number. Until patched, restrict network reachability of the Oracle Lease and Finance Management module to trusted internal users only (front it behind VPN/segmentation and Oracle EBS URL firewall / allow-list rules), review and minimize low-privilege account grants to the affected responsibilities, and increase auditing on Lease and Finance Management data access - note these controls reduce exposure but do not remediate the underlying authorization flaw and may impede legitimate remote users.