What is the CVSS score of CVE-2026-60892?

CVE-2026-60892 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Oracle HRMS Norway CVE-2026-60892

EUVD-2026-47168 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-h2rf-8w3c-98w8

Authentication Bypass Oracle Human Resources Management System

6.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.6 MEDIUM

Network-reachable via HTTP but PR:H and AC:H required; full C/I/A takeover confirmed; scope unchanged per Oracle description.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:42 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Norway Payroll). Supported versions that are affected are 12.2.8-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HRMS (Norway). Successful attacks of this vulnerability can result in takeover of Oracle HRMS (Norway). CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle HRMS (Norway) - the Norway Payroll component within Oracle E-Business Suite - is possible for a high-privileged attacker who can satisfy difficult exploitation conditions over HTTP across versions 12.2.8 through 12.2.15. Despite the complete C/I/A impact, the CVSS 3.1 score of 6.6 reflects real-world constraints: both high attack complexity (AC:H) and high privilege requirements (PR:H) must be met, making opportunistic mass exploitation unlikely. No public exploit code or CISA KEV listing has been identified at time of analysis, consistent with this being a targeted, insider-threat-class risk.

Technical ContextAI

Oracle HRMS (Norway) is a country-localized human resources and payroll module within Oracle E-Business Suite (EBS), Oracle's enterprise ERP platform. The vulnerable component - Norway Payroll - handles country-specific payroll computation and statutory reporting for Norwegian operations. The attack vector is network-reachable via HTTP (AV:N), indicating the flaw resides in the EBS web application tier rather than requiring direct OS or database access. No CWE classification is provided, which limits root-cause specificity; however, Oracle's 'Information Disclosure' tag alongside a full takeover outcome (C:H/I:H/A:H) may indicate improper authorization enforcement, privilege escalation, or server-side logic flaws within the payroll processing pipeline. The ENISA EUVD entry EUVD-2026-47168 and Oracle's July 2026 Critical Patch Update (CPU) are the primary corroborating sources; no CPE strings were included in the available intelligence.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update, which addresses this vulnerability; the advisory is published at https://www.oracle.com/security-alerts/cpujul2026.html and patch delivery is through Oracle My Oracle Support. The exact patched release version is not independently confirmed from the available data beyond the CPU release itself - consult Oracle My Oracle Support for the specific patch set applicable to the Norway Payroll component on your EBS version. As compensating controls prior to patching, restrict network access to the Oracle EBS application tier to trusted internal networks only, since AV:N exploitation requires HTTP reachability - this does not eliminate the vulnerability but raises the barrier given AC:H. Additionally, audit and reduce the number of accounts holding high-level HRMS administration privileges (PR:H required), enforce multi-factor authentication on all EBS admin accounts, and review privilege-use logs on the Norway Payroll component for anomalous activity. Note that network restriction alone is insufficient if the threat model includes malicious insiders with legitimate access.