What is the CVSS score of CVE-2026-60859?

CVE-2026-60859 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Quoting are affected by CVE-2026-60859?

Oracle E-Business Suite's Quoting module is vulnerable to complete compromise by authenticated, low-privileged users, potentially exposing critical pricing and quote data to unauthorized access,…

How to fix or mitigate CVE-2026-60859?

Within 24 hours, verify whether Oracle E-Business Suite with the Quoting module is deployed in your environment and document all instances, access methods, and user accounts with permissions. Within 7 days, implement network segmentation to restrict access to the Quoting module, enable enhanced logging and monitoring of module access, and audit all low-privileged user accounts to ensure their Quoting permissions remain necessary. Within 30 days, monitor Oracle's Critical Patch Update advisories for the availability of a patch to CVE-2026-60859, and evaluate feasibility of upgrading to a patched E-Business Suite version; maintain strict network and application-level access controls limiting Quoting access to the minimum necessary users until patching is complete.

Oracle Quoting CVE-2026-60859

EUVD-2026-47152 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-vp8c-c6c6-r9rv

Privilege Escalation Oracle Quoting

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network HTTP reach (AV:N) with authenticated low-privileged access (PR:L), difficult-to-exploit conditions (AC:H), no user interaction, and full takeover of Quoting yielding C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:43 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Quoting product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Quoting. Successful attacks of this vulnerability can result in takeover of Oracle Quoting. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Quoting (a module of Oracle E-Business Suite) is possible for an authenticated, low-privileged attacker reaching the application over HTTP, per Oracle's July 2026 Critical Patch Update. Successful exploitation results in complete takeover of the Quoting component with high impact to confidentiality, integrity, and availability, though Oracle rates the attack complexity as high (difficult to exploit). No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Oracle Quoting is part of the Oracle E-Business Suite (EBS) applications platform, specifically the flagged 'Internal Operations' component, running on the Oracle Application Server / Java web tier that fronts the EBS database. The affected code is reached via HTTP against the EBS application front-end, which is a common exposure surface for internet- or intranet-facing ERP deployments. Oracle assigned no CWE (CWE: N/A) and provides only a terse description, so the precise root-cause class (e.g., injection, access-control, or deserialization) cannot be determined from the available data; the 'Information Disclosure' tag and the C:H/I:H/A:H impact together suggest a flaw allowing an authenticated user to escalate to full control of the Quoting module rather than a pure read-only leak.

RemediationAI

Patch available per vendor advisory: apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which covers Oracle E-Business Suite 12.2.3-12.2.15; Oracle does not publish standalone fix version strings outside the CPU, so no exact patched build number is independently confirmed here - follow the CPU's EBS patch matrix for your exact release. Until the CPU is applied, reduce exposure by restricting network access to the EBS application tier and the Quoting URLs to trusted internal networks or VPN only (removing any direct internet exposure), tightening the responsibilities/roles that grant access to the Quoting module so fewer low-privileged accounts can reach it, and increasing monitoring of Quoting and Internal Operations transactions for anomalous activity. Note the trade-offs: network restriction may break legitimate external sales/partner access to quoting workflows, and role tightening can disrupt users who legitimately need the module, so validate against business processes before enforcing.