What is the CVSS score of CVE-2026-60899?

CVE-2026-60899 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle E-Business Suite CVE-2026-60899

EUVD-2026-47174 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-mmrw-mxrr-g7qh

Authentication Bypass Information Disclosure Oracle Human Capital Management Configuration Workbench

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible HTTP endpoint requiring only a low-privilege account; impact is confidentiality-only with no integrity or availability effect confirmed by description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:41 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite (component: Rapid Implementation). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Configuration Workbench. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HCM Configuration Workbench accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle HCM Configuration Workbench (Rapid Implementation component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker to gain complete access to all data accessible within the application via HTTP. Tagged as an Authentication Bypass, the flaw indicates that a legitimately authenticated user with minimal privileges can circumvent authorization controls to access sensitive HCM data well beyond their entitlement - covering employee PII, compensation structures, and organizational data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range spanning twelve supported minor releases elevate operational risk in large enterprise environments running externally accessible EBS instances.

Technical ContextAI

Oracle HCM Configuration Workbench is a component of Oracle E-Business Suite (EBS), a large-scale enterprise resource planning platform used primarily by large organizations for HR, finance, and supply chain management. The Rapid Implementation sub-component facilitates accelerated deployment and configuration of Human Capital Management modules, typically handling highly sensitive employee, payroll, and organizational data. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates the flaw is reachable over HTTP with no special protocol configuration required beyond holding a low-privilege EBS account. No CWE was assigned in the available data, making root-cause classification speculative; however, the 'Authentication Bypass' tag suggests an authorization or access-control deficiency consistent with CWE-284 (Improper Access Control) or CWE-863 (Incorrect Authorization) rather than a code execution or injection class vulnerability. Affected CPE strings were not explicitly provided in the intelligence feed; the confirmed affected version range is 12.2.3 through 12.2.15 per EUVD-2026-47174 and the Oracle CPU July 2026 advisory.

RemediationAI

Apply the patches distributed in the Oracle Critical Patch Update (CPU) for July 2026, available via https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publish individual patch version numbers in public advisories; customers must consult My Oracle Support (MOS) for the specific patch ID applicable to their EBS release within the 12.2.3-12.2.15 range. The CPU is released quarterly, and Oracle's standard guidance is to apply all applicable CPU patches as soon as operationally feasible. As a compensating control prior to patching, restrict network-level access to the Rapid Implementation component of Oracle HCM Configuration Workbench at the perimeter firewall or Web Application Firewall, limiting reachability to trusted internal IP ranges; note this reduces but does not eliminate risk from insider threats or attackers already on the corporate network or VPN. Additionally, audit access logs for the Rapid Implementation endpoint to detect anomalous low-privilege data access patterns that may indicate prior exploitation activity.