What is the CVSS score of CVE-2026-60880?

CVE-2026-60880 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60880?

Oracle E-Business Suite Work in Process module (CVE-2026-60880, CVSS 9.8) is vulnerable to unauthenticated remote takeover via HTTP, enabling any attacker with network access to gain complete control…

How to fix or mitigate CVE-2026-60880?

Within 24 hours: immediately restrict HTTP network access to the WIP module to authorized subnets only using firewall rules and IP allowlisting at perimeter and load balancer layers. Within 7 days: deploy Web Application Firewall rules to enforce strict access controls on WIP endpoints, enable comprehensive audit logging for all WIP module transactions, and configure real-time alerts for anomalous access patterns and failed authentication attempts. Within 30 days: establish continuous monitoring of Oracle's security advisories for CVE-2026-60880 patch release; coordinate with Oracle Support to identify interim hotfixes or risk mitigation options; implement network segmentation isolating WIP module infrastructure on a dedicated VLAN with restricted outbound connectivity; and prepare a tested patching procedure ready for immediate deployment upon patch availability.

Oracle E-Business Suite CVE-2026-60880

EUVD-2026-47163 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-mxf6-p28m-fjg7

Authentication Bypass Oracle Work In Process

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated, easily exploitable HTTP attack yielding takeover, so AV:N/AC:L/PR:N/UI:N with full C:H/I:H/A:H, matching the 9.8 base.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:39 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Work in Process. Successful attacks of this vulnerability can result in takeover of Oracle Work in Process. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of the Oracle Work in Process (WIP) module of Oracle E-Business Suite (component: Internal Operations) allows an unauthenticated attacker with only HTTP network access to fully compromise the application. Oracle rates this 9.8 with full confidentiality, integrity and availability impact and describes it as 'easily exploitable,' meaning no authentication, no user interaction and low attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network attack profile makes it a top-priority patch in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle Work in Process is the shop-floor/manufacturing execution module of Oracle E-Business Suite (EBS), the vendor's large-scale ERP platform typically fronted by Oracle Application Server / WebLogic and exposed over HTTP. The affected 'Internal Operations' component handles internal manufacturing and material transactions. No CWE was assigned (CWE: N/A) so the exact root cause class is not published by Oracle; however, the CVSS profile (network vector, no privileges, no interaction, full CIA loss described as 'takeover') is consistent with the classic EBS attack surface of unauthenticated, pre-login servlet/endpoint flaws (e.g., injection, deserialization, or authentication-bypass style issues) that Oracle has repeatedly patched in EBS Critical Patch Updates. Because EBS shares a common technology stack across modules, the exposed HTTP endpoint is likely reachable through the standard EBS web tier rather than being unique to WIP.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) - patch available per vendor advisory; Oracle publishes the specific EBS 12.2 patch numbers in that CPU rather than a single fix version string, so map your exact 12.2.3-12.2.15 level to the corresponding CPU patch and apply it. Oracle strongly recommends never running unpatched EBS and applying CPUs promptly. As compensating controls until patched, restrict network reachability of the EBS web tier: place it behind a VPN or trusted network, block direct internet exposure of the WIP/Internal Operations HTTP endpoints, and use URL firewall / reverse-proxy allowlisting (Oracle EBS supports a URL firewall / DMZ configuration) to deny unauthenticated access to non-essential servlets - with the trade-off that overly aggressive allowlisting can break legitimate integrations or self-service flows, so test in staging. Increase WAF and web-tier logging/monitoring on these endpoints to detect exploitation attempts.