What is the CVSS score of CVE-2026-60900?

CVE-2026-60900 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60900?

A vulnerability in Oracle E-Business Suite's Human Capital Management Configuration Workbench (versions 12.2.3-12.2.15) allows attackers with administrative access to compromise the entire module,…

How to fix or mitigate CVE-2026-60900?

Within 24 hours, conduct an inventory of all deployed Oracle E-Business Suite instances and verify which systems run versions 12.2.3-12.2.15 to determine exposure to CVE-2026-60900. Within 7 days, deploy the July 2026 Critical Patch Update from Oracle to all affected E-Business Suite installations, prioritizing production environments hosting the HCM Configuration Workbench. Within 30 days, review access controls to this module, audit logs for suspicious activity, and validate that only necessary personnel retain administrative privileges to the HCM Configuration Workbench.

Oracle E-Business Suite CVE-2026-60900

EUVD-2026-47175 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-xrm2-cc7q-4rx2

Privilege Escalation Oracle Human Capital Management Configuration Workbench

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network HTTP access with low complexity, but requires high administrative EBS privileges (PR:H); full module takeover yields C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:35 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite (component: Rapid Implementation). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HCM Configuration Workbench. Successful attacks of this vulnerability can result in takeover of Oracle HCM Configuration Workbench. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle HCM Configuration Workbench (Rapid Implementation component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a high-privileged, network-authenticated attacker to take over the module over HTTP with high confidentiality, integrity, and availability impact. Oracle addressed the flaw in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis, and it is not listed in CISA KEV. Despite the vendor 'Information Disclosure' tag, the CVSS vector reflects a full C/I/A takeover rather than mere data exposure.

Technical ContextAI

The affected technology is Oracle E-Business Suite, Oracle's flagship on-premises ERP platform, specifically the Human Capital Management (HCM) Configuration Workbench and its Rapid Implementation component used to accelerate module setup and configuration. The vulnerability sits within an authenticated web-facing servlet/JSP tier of the EBS 12.2 middleware stack. Oracle did not assign a CWE (listed as N/A) and did not disclose the specific weakness class, which is standard practice for Oracle Critical Patch Update entries; based on the vendor 'Information Disclosure' tag combined with a full C/I/A takeover vector, the root cause is likely improper access control or input handling within a privileged administrative function rather than a classic memory-safety bug.

RemediationAI

Apply the fix delivered in the Oracle July 2026 Critical Patch Update (patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html); Oracle CPUs are cumulative, so apply the current EBS 12.2 patch level rather than an isolated hotfix, and no exact standalone fix version was published in the input beyond the CPU reference. Because exploitation requires a high-privileged EBS account, compensating controls until patching completes include tightly restricting and auditing administrative EBS roles and the HCM Configuration Workbench / Rapid Implementation responsibilities, limiting network reachability of the EBS application tier to trusted management networks or VPN (trade-off: may disrupt remote administrators), and enabling detailed access logging on the affected servlet endpoints to detect anomalous privileged use. Enforcing least privilege and reviewing which accounts truly need Rapid Implementation access directly shrinks the exploitable population without functional side effects on ordinary users.