What is the CVSS score of CVE-2026-60886?

CVE-2026-60886 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60886?

Oracle Work in Process (manufacturing module in E-Business Suite versions 12.2.3-12.2.15) permits low-privileged internal users to access and manipulate production data through social-engineering…

How to fix or mitigate CVE-2026-60886?

Within 24 hours, identify all Oracle E-Business Suite systems running Work in Process versions 12.2.3-12.2.15, document current user privileges, and assess data exposure scope. Within 7 days, restrict WIP module access through role-based permissions to essential personnel only, implement comprehensive audit logging for all WIP data access and modifications, enable network segmentation for HTTP access to the module, and conduct mandatory security awareness training for manufacturing and operations staff focused on social-engineering prevention. Within 30 days, apply the Oracle Critical Patch Update scheduled for July 2026 or the next available patch release addressing CVE-2026-60886; if patch deployment cannot be expedited, evaluate disabling the WIP module or implementing additional authentication requirements such as multi-factor authentication to reduce attack surface pending remediation.

Oracle E-Business Suite CVE-2026-60886

EUVD-2026-47164 HIGH

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-3wx4-5jhr-fh5x

Authentication Bypass Information Disclosure Oracle Work In Process

7.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

vuln.today AI

7.6 HIGH

HTTP-reachable (AV:N/AC:L) but needs a valid low-privilege account (PR:L) and a second user's interaction (UI:R); cross-product reach gives S:C with high read (C:H), partial write (I:L), no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:39 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.6

DescriptionCVE.org

Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Work in Process. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Work in Process, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Work in Process accessible data as well as unauthorized update, insert or delete access to some of Oracle Work in Process accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).

AnalysisAI

Compromise of Oracle Work in Process, a manufacturing module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15, Internal Operations component), allows a low-privileged authenticated attacker with HTTP network access to read all data accessible to Work in Process and to alter some of it, with a scope change that can significantly impact additional Oracle products. Exploitation is rated easy by Oracle but requires human interaction from a victim other than the attacker (UI:R), pointing to a social-engineering or cross-user trigger. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the fix ships in the Oracle Critical Patch Update of July 2026.

Technical ContextAI

Oracle Work in Process (WIP) is the shop-floor / manufacturing execution module within Oracle E-Business Suite (EBS), the Oracle 12.2.x enterprise ERP application stack delivered over Oracle Application Server / WebLogic front ends and accessed via HTTP. The affected functionality is the 'Internal Operations' component. Oracle assigned no CWE, but the combination of a required cross-user interaction (UI:R), scope change (S:C), and Oracle's own 'Authentication Bypass' tag is consistent with a web-layer injection or request-forgery style flaw where an attacker's action is executed in the context of, or bridges into, another user or product boundary. The scope change (S:C) is significant: the vulnerable code is in WIP, but successful attacks can reach data and functions in other Oracle EBS products sharing the same environment, so the blast radius is not confined to WIP alone.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) - patch available per vendor advisory; Oracle does not publish a standalone fixed sub-version, so apply the CPU patch set corresponding to your 12.2.x level. Because Oracle explicitly states these vulnerabilities are easily exploitable and warns against delay, prioritize this CPU. Until patching completes, reduce exposure by restricting network reachability of the EBS/WIP HTTP endpoints to trusted internal networks or VPN (trade-off: may break legitimate remote or partner access), tightening EBS account provisioning so that low-privilege accounts are minimized and reviewed, and briefing users against clicking untrusted links into EBS since exploitation depends on victim interaction (trade-off: awareness controls are only partially effective). Do not rely on these compensating controls as a substitute for the CPU patch.