What is the CVSS score of CVE-2026-60872?

CVE-2026-60872 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

How to fix or mitigate CVE-2026-60872?

Within 24 hours, inventory all Oracle EBS 12.2.3-12.2.15 deployments with Order Management enabled and assess whether the Product Diagnostic Tools component is accessible via HTTP/HTTPS from outside internal networks. Within 7 days, implement firewall rules restricting HTTP/HTTPS access to Product Diagnostic Tools to essential internal IP ranges only; disable the component entirely if operational requirements permit; and enable comprehensive audit logging on the Order Management module. Within 30 days, contact Oracle Support to confirm patch availability for your specific EBS release; evaluate upgrade pathways to supported EBS releases (12.2.16 or later, or Oracle Cloud); and establish weekly log review procedures to detect unauthorized access or privilege escalation attempts.

Oracle Order Management CVE-2026-60872

EUVD-2026-47160 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-xgqw-2h6m-8x8q

Privilege Escalation Oracle Order Management

8.8

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain low-privilege EBS credentials
Delivery

Reach Product Diagnostic Tools over HTTP
Exploit

Send crafted request exploiting diagnostic component
Execution

Escalate to full module control
Impact

Take over Oracle Order Management data

Vulnerability Assessment

Weakness	CWE CWE-269 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Least privilege enforcement MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires network access to the Oracle EBS application over HTTP and a low-privileged authenticated account (CVSS PR:L), targeting the Product Diagnostic Tools component of Oracle Order Management on EBS releases 12.2.3 through 12.2.15. No user interaction is needed (UI:N) and complexity is low (AC:L), so any holder of even minimal EBS credentials who can reach the diagnostic endpoints can attempt it. Limiting factors: the requirement for a valid low-privilege session means fully unauthenticated exploitation is not indicated by the vector, and instances that do not expose the EBS web tier / diagnostic tooling to the attacker's network reduce reachability; only the 12.2.x line is listed as affected.
Impact	The signals are largely consistent and point to a genuine priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) indicates remote, low-complexity, single-privilege exploitation with no user interaction and total impact on the module - Oracle's own 'easily exploitable' language reinforces low AC. Mitigating the raw score: PR:L means the attacker needs at least a low-privileged EBS account, which limits fully anonymous internet exploitation. No EPSS score was provided, the vulnerability is not in CISA KEV, and no POC is referenced, so there is no evidence of active or automated exploitation yet. Net assessment: high-value target (ERP takeover) with a modest authentication prerequisite - treat as a high patch priority rather than an emergency zero-day, but note that EBS environments often have many low-privilege internal/vendor accounts, which effectively lowers the PR:L barrier in practice.
Exploit ScenarioDerived	An attacker who holds or phishes a low-privileged Oracle EBS account (or reaches an internet-exposed EBS instance) sends crafted HTTP requests to the Product Diagnostic Tools component of Order Management. Because the flaw is low-complexity and requires no user interaction, the attacker escalates from that limited access to full takeover of the Order Management module, allowing theft or manipulation of order-to-cash data. No public exploit code is currently identified, so this reflects a plausible path rather than an observed campaign.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Full compromise of Oracle Order Management, a module of Oracle E-Business Suite (EBS), is possible via the Product Diagnostic Tools component, where a low-privileged attacker with HTTP network access can achieve complete takeover of the module. Oracle rates the flaw 8.8 (High) and describes it as 'easily exploitable,' with full confidentiality, integrity, and availability impact across EBS releases 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low complexity and low privilege bar make it a strong patch priority.

RemediationAI

Apply the fixes in Oracle's July 2026 Critical Patch Update (patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships EBS security fixes as consolidated CPU patches rather than a single tagged version, so identify and apply the specific 12.2.x CPU patch for your release from the CPU patch matrix. No independent standalone fix version was provided in the input, so confirm the exact patch number in the CPU advisory. If patching cannot be done immediately, restrict network access to the Product Diagnostic Tools endpoints and the EBS application tier (for example via URL firewall / mod_security rules on the Oracle HTTP Server and by limiting exposure to trusted internal networks or VPN), and audit and minimize low-privileged EBS accounts since PR:L is the key prerequisite - the trade-off is that overly aggressive URL blocking can break legitimate diagnostic and support workflows, so test rules before enforcing them.

Affected VersionsENISA

Oracle Order Management 12.2.3 ≤12.2.15

Affected Packages

euvd oracle_order_management no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle E-Business Suite is Oracle's flagship on-premises ERP suite; Order Management handles the order-to-cash business process. The affected surface is the Product Diagnostic Tools component, a web-accessible diagnostic/administrative facility reachable over HTTP within the EBS application tier. No CWE was assigned by Oracle or NVD, so the precise root-cause class (e.g., injection, access-control bypass, or authorization flaw) cannot be confirmed from the provided data; the 'Information Disclosure' tag combined with a full C/I/A impact suggests the diagnostic tooling exposes functionality that, once reached by an authenticated low-privilege user, permits actions well beyond read-only access. EBS 12.2.x runs on the Oracle Application Server / WebLogic-based middle tier, so exploitation is against the HTTP-facing application, not the underlying database directly.

Know when Order Management gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

Remote HTTP vector with low complexity and no user interaction, but a low-privileged EBS account is required (PR:L); full module takeover yields C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management. Successful attacks of this vulnerability can result in takeover of Oracle Order Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive ViewAI

Why It Matters

Oracle Order Management (EBS 12.2.3-12.2.15) contains a high-severity vulnerability (CVE-2026-60872, CVSS 8.8) allowing authenticated attackers with low privilege to achieve complete module compromise, impacting order processing, inventory visibility, and financial data integrity. No public exploit identified at time of analysis; however, the low exploitation barrier creates urgent risk for organizations dependent on Order Management for revenue and supply chain operations.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to Product Diagnostic Tools via firewall or WAF to internal-only connectivity; disable the component if not required for business operations; implement enhanced monitoring and alerting on all Order Management module access, particularly for administrative actions; enforce least-privilege database and application roles for EBS users; review and restrict user account privileges with access to the vulnerable component; conduct immediate audit of existing user sessions and API access for anomalies.

Threat Intelligence Overview

EPSS Score

0.5%

Top 61% exploitable

Prevalence

Medium

major enterprise ERP, common in large orgs but not ubiquitous

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.5%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.