What is the CVSS score of CVE-2026-60898?

CVE-2026-60898 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Warehouse Management are affected by CVE-2026-60898?

Organizations using Oracle Warehouse Management (Oracle E-Business Suite versions 12.2.3-12.2.15) face a high-severity vulnerability (CVE-2026-60898, CVSS 8.8) that allows internal staff with…

How to fix or mitigate CVE-2026-60898?

Within 24 hours: Catalog all Oracle E-Business Suite systems running Warehouse Management versions 12.2.3-12.2.15; identify users with OWM access and review their privilege levels; restrict network access to OWM module to only essential users and systems. Within 7 days: Implement comprehensive audit logging for all OWM user activities and review historical logs for suspicious access patterns; update firewall rules to restrict OWM connectivity; verify Oracle's July 2026 Critical Patch Update is available and schedule testing. Within 30 days: Apply the July 2026 Oracle Critical Patch Update addressing CVE-2026-60898 to all affected production Warehouse Management instances after successful validation in non-production environments.

Oracle Warehouse Management CVE-2026-60898

EUVD-2026-47173 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-hf5f-75f8-j8wc

Privilege Escalation Oracle Warehouse Management

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

HTTP-reachable and low-complexity, but a valid low-privileged EBS account is required (PR:L); described impact is full takeover so C/I/A all High with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:36 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Warehouse Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Warehouse Management. Successful attacks of this vulnerability can result in takeover of Oracle Warehouse Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Privilege-escalation-to-takeover in Oracle Warehouse Management (Internal Operations component of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a low-privileged, authenticated attacker with network access over HTTP to fully compromise the module. Because CVSS scope is unchanged but all three impacts (C/I/A) are High, a successful attack results in complete takeover of Oracle Warehouse Management. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it is addressed in the Oracle Critical Patch Update of July 2026.

Technical ContextAI

Oracle Warehouse Management (WMS) is a supply-chain execution module packaged within Oracle E-Business Suite (EBS) 12.2, a large Java/PL-SQL enterprise application stack fronted by the Oracle HTTP Server and accessed over HTTP. The vulnerable code lives in the 'Internal Operations' component. Oracle does not publish a CWE for CPU entries, so the precise root-cause class is not disclosed; the vendor tag 'Information Disclosure' plus the full C/I/A High impact and PR:L vector are consistent with an authorization/injection weakness reachable by any authenticated EBS user that lets them act beyond their entitlements within the WMS module. Affected releases span the entire supported 12.2 line (12.2.3 through 12.2.15).

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 as documented at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle ships EBS security fixes as consolidated CPU patches rather than a single incremented version number, so identify and apply the specific WMS/EBS 12.2 patch listed in that advisory for your installed release (the input does not name an exact fix build, so confirm the patch number in the CPU matrix). Until patched, reduce exposure by ensuring the EBS instance is not internet-facing and is restricted to trusted networks or VPN, tightening WMS/Internal Operations responsibility and role assignments so only necessary users hold accounts, and monitoring EBS access logs for anomalous WMS activity - note that restricting responsibilities may disrupt legitimate warehouse operators and should be validated against business workflows before enforcement.