What is the CVSS score of CVE-2026-60904?

CVE-2026-60904 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60904?

Oracle E-Business Suite Installed Base modules (versions 12.2.3-12.2.15) expose asset inventory and customer equipment data to unauthorized modification by any authenticated network user, creating…

How to fix or mitigate CVE-2026-60904?

Within 24 hours, complete an inventory of all Oracle E-Business Suite instances deployed, identifying those running versions 12.2.3 through 12.2.15 and prioritizing systems containing sensitive Installed Base data. Over the next 7 days, implement immediate compensating controls by restricting network access to the Installed Base module to business-critical personnel only, enforcing multi-factor authentication for all EBS accounts, and enabling enhanced audit logging on Installed Base transactions to detect unauthorized modification. Within 30 days, establish formal vendor engagement with Oracle for patch availability timelines; pending patch release, prepare a technical control strategy including application-level access restrictions, database-level row-level security policies on Installed Base tables, and network segmentation by department to minimize attacker reach.

Oracle E-Business Suite CVE-2026-60904

EUVD-2026-47177 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-6jfc-m33v-j93r

Authentication Bypass Oracle Installed Base

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reach and low complexity, but requires a low-privilege EBS account (PR:L); full data read/write gives C:H/I:H with no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:35 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Installed Base accessible data as well as unauthorized access to critical data or complete access to all Oracle Installed Base accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle E-Business Suite's Installed Base module (Create Item Instance component) lets a low-privileged, network-authenticated attacker read, create, delete, or modify all Installed Base data across releases 12.2.3 through 12.2.15. The CVSS 3.1 base score is 8.1 (C:H/I:H, no availability impact), reflecting full read/write compromise of the module's data without affecting uptime. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network vector make it a high-priority patch item for EBS operators.

Technical ContextAI

Oracle Installed Base (CSI) is the asset-tracking module of Oracle E-Business Suite that records deployed product instances, their configurations, and ownership across the customer lifecycle. The flaw resides in the 'Create Item Instance' code path, reachable over HTTP through the EBS application tier. Oracle does not map a CWE for this advisory, but the described impact - an already-authenticated low-privilege user gaining unauthorized read and write access to all data the module can reach - is characteristic of a missing or broken authorization/access-control check (privilege escalation within the application) rather than a memory-safety issue. The 'Authentication Bypass' tag is inconsistent with the CVSS PR:L metric, which requires the attacker to already hold low-level credentials; this discrepancy should be verified against Oracle's advisory.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); no discrete fixed EBS version string is given in the input, so treat this as 'Patch available per vendor advisory' and install the specific 12.2.x CPU patch Oracle maps to your release level rather than an invented version number. Because exploitation only requires a low-privilege authenticated account, until the CPU is applied reduce risk by tightening EBS user provisioning and revoking unnecessary accounts, restricting network reachability of the EBS application tier to trusted networks/VPN, and auditing Installed Base (CSI) responsibilities and menus to limit who can invoke Create Item Instance functionality; be aware that restricting responsibilities may disrupt legitimate asset-management workflows and network restrictions may block remote or partner users. Monitor Installed Base data for anomalous creation, deletion, or modification as a detective control.