What is the CVSS score of CVE-2026-60854?

CVE-2026-60854 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L. EPSS exploitation probability: 0.4%.

Which versions of Oracle Quality are affected by CVE-2026-60854?

Oracle Quality in E-Business Suite 12.2.3-12.2.15 contains a high-severity vulnerability enabling authenticated high-privilege attackers with HTTP network access to read sensitive data, modify…

How to fix or mitigate CVE-2026-60854?

Within 24 hours, identify all Oracle E-Business Suite 12.2.3-12.2.15 instances in your environment, confirm which have Oracle Quality enabled, and audit current HTTP network access controls to determine exposure scope. Within 7 days, restrict HTTP network access to Oracle Quality to only documented business-critical users and systems; implement role-based access controls to limit Oracle Quality operations to high-privilege accounts with specific business justification; and enable detailed audit logging for all data access and modification. Within 30 days, contact Oracle support to identify any available workarounds or mitigation strategies; evaluate feasibility of upgrading to version 12.2.16 or later; and establish a timeline for patching once vendor releases are available.

Oracle Quality CVE-2026-60854

EUVD-2026-47149 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-2795-vvmf-mqf8

Authentication Bypass Privilege Escalation Denial Of Service Oracle Quality

8.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L

vuln.today AI

8.2 HIGH

Network HTTP reach with low complexity, but requires a high-privilege EBS account (PR:H); scope change (S:C) to other components with high confidentiality and low integrity/availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:45 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.2

DescriptionCVE.org

Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Quality. While the vulnerability is in Oracle Quality, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Quality accessible data as well as unauthorized update, insert or delete access to some of Oracle Quality accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Quality. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L).

AnalysisAI

Privileged compromise of Oracle Quality, a component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), allows a high-privileged attacker with HTTP network access to read all Oracle Quality-accessible data, partially modify data, and cause partial denial of service. Because the flaw carries a scope change (S:C), successful attacks can significantly impact additional products beyond Oracle Quality itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 3.1 base score of 8.2 reflects meaningful confidentiality and cross-component risk.

Technical ContextAI

Oracle Quality is a manufacturing quality-management module within the Oracle E-Business Suite (EBS) 12.2 application stack, exercised here through its 'Internal Operations' component over HTTP against the EBS application tier (typically Oracle WebLogic/Oracle HTTP Server fronting the E-Business Suite forms and self-service web pages). No CWE was assigned by the source, so the precise root-cause class is not formally categorized; the scope change (S:C) combined with confidentiality-dominant impact is consistent with an authorization/access-control weakness where an authenticated EBS user with elevated application privileges can reach data and functionality belonging to other EBS components. The affected code path is reachable across the entire supported 12.2.x line (12.2.3-12.2.15), indicating a long-standing issue in the Quality module rather than a regression in a single release.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html); Oracle does not publish standalone semantic version numbers for EBS fixes, so identify and apply the specific CPU patch for your 12.2.x level rather than a named upstream release. No exact standalone fix version was provided in the input, so confirm the applicable patch number directly from the July 2026 CPU documentation for Oracle E-Business Suite. Because exploitation requires a high-privilege account, effective compensating controls until patching include tightly restricting and auditing which users hold elevated Oracle Quality / EBS responsibilities, limiting network access to the EBS application tier to trusted internal segments and VPN, and enabling monitoring of privileged HTTP activity against the Quality module - noting the trade-off that access restrictions may disrupt legitimate remote or integration users. No unauthenticated workaround removes the risk, so patching should not be deferred for privileged-heavy deployments.