Risk Management CVE-2026-60871

A high-severity data compromise vulnerability in Oracle Risk Management (E-Business Suite 12.2.3-12.2.15) allows authenticated users with low privilege to read, create, modify, or delete all application data via HTTP access; no public exploit identified at time of analysis. Organizations running affected versions face immediate operational risk from insider threats or compromised low-privilege credentials.

Within 24 hours: identify all systems running Oracle E-Business Suite 12.2.3 through 12.2.15 with Risk Management active and document network access paths to these systems. Within 7 days: restrict HTTP access to Risk Management modules to trusted administrators only via firewall rules; disable the Internal Operations component if not business-critical; audit and remove unnecessary low-privilege account permissions to Risk Management data. Within 30 days: contact Oracle Support to confirm patch availability (no vendor-released patch identified at time of analysis); evaluate upgrade to Oracle E-Business Suite 12.2.16 or later when released; implement continuous monitoring for unauthorized read/write/delete operations in Risk Management.

Network segmentation restricting Risk Management HTTP access to administrative personnel only; disable the Internal Operations module if operationally feasible; enforce multi-factor authentication for all E-Business Suite accounts; implement database-level audit logging and row-level security controls on Risk Management tables; establish weekly anomaly detection reviews for all privileged and low-privilege account activity targeting Risk Management data.