What is the CVSS score of CVE-2026-60872?

CVE-2026-60872 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Order Management are affected by CVE-2026-60872?

Oracle Order Management (EBS 12.2.3-12.2.15) contains a high-severity vulnerability (CVE-2026-60872, CVSS 8.8) allowing authenticated attackers with low privilege to achieve complete module…

How to fix or mitigate CVE-2026-60872?

Within 24 hours, inventory all Oracle EBS 12.2.3-12.2.15 deployments with Order Management enabled and assess whether the Product Diagnostic Tools component is accessible via HTTP/HTTPS from outside internal networks. Within 7 days, implement firewall rules restricting HTTP/HTTPS access to Product Diagnostic Tools to essential internal IP ranges only; disable the component entirely if operational requirements permit; and enable comprehensive audit logging on the Order Management module. Within 30 days, contact Oracle Support to confirm patch availability for your specific EBS release; evaluate upgrade pathways to supported EBS releases (12.2.16 or later, or Oracle Cloud); and establish weekly log review procedures to detect unauthorized access or privilege escalation attempts.

Oracle Order Management CVE-2026-60872

EUVD-2026-47160 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-xgqw-2h6m-8x8q

Privilege Escalation Oracle Order Management

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote HTTP vector with low complexity and no user interaction, but a low-privileged EBS account is required (PR:L); full module takeover yields C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:41 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management. Successful attacks of this vulnerability can result in takeover of Oracle Order Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Order Management, a module of Oracle E-Business Suite (EBS), is possible via the Product Diagnostic Tools component, where a low-privileged attacker with HTTP network access can achieve complete takeover of the module. Oracle rates the flaw 8.8 (High) and describes it as 'easily exploitable,' with full confidentiality, integrity, and availability impact across EBS releases 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low complexity and low privilege bar make it a strong patch priority.

Technical ContextAI

Oracle E-Business Suite is Oracle's flagship on-premises ERP suite; Order Management handles the order-to-cash business process. The affected surface is the Product Diagnostic Tools component, a web-accessible diagnostic/administrative facility reachable over HTTP within the EBS application tier. No CWE was assigned by Oracle or NVD, so the precise root-cause class (e.g., injection, access-control bypass, or authorization flaw) cannot be confirmed from the provided data; the 'Information Disclosure' tag combined with a full C/I/A impact suggests the diagnostic tooling exposes functionality that, once reached by an authenticated low-privilege user, permits actions well beyond read-only access. EBS 12.2.x runs on the Oracle Application Server / WebLogic-based middle tier, so exploitation is against the HTTP-facing application, not the underlying database directly.

RemediationAI

Apply the fixes in Oracle's July 2026 Critical Patch Update (patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships EBS security fixes as consolidated CPU patches rather than a single tagged version, so identify and apply the specific 12.2.x CPU patch for your release from the CPU patch matrix. No independent standalone fix version was provided in the input, so confirm the exact patch number in the CPU advisory. If patching cannot be done immediately, restrict network access to the Product Diagnostic Tools endpoints and the EBS application tier (for example via URL firewall / mod_security rules on the Oracle HTTP Server and by limiting exposure to trusted internal networks or VPN), and audit and minimize low-privileged EBS accounts since PR:L is the key prerequisite - the trade-off is that overly aggressive URL blocking can break legitimate diagnostic and support workflows, so test rules before enforcing them.