What is the CVSS score of CVE-2026-60908?

CVE-2026-60908 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60908?

Oracle Installed Base within E-Business Suite (versions 12.2.3-12.2.15) contains an authorization vulnerability enabling low-privileged users to access and modify sensitive operational data via…

How to fix or mitigate CVE-2026-60908?

Within 24 hours: Identify and document all Oracle E-Business Suite installations using versions 12.2.3 through 12.2.15. Within 7 days: Deploy network access restrictions to the Installed Base module (restrict to authorized IP ranges and users), enable detailed audit logging, and establish monitoring for abnormal data access. Within 30 days: Upgrade to E-Business Suite versions below 12.2.3 or 12.2.16 and above, or implement vendor-approved compensating controls; audit transaction logs since July 2026 for evidence of unauthorized access.

Oracle E-Business Suite CVE-2026-60908

EUVD-2026-47179 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-wj2c-96w6-5wh7

Authentication Bypass Oracle Installed Base

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Network HTTP access with an authenticated low-privileged account (PR:L) and no user interaction; full read access (C:H) but only partial writes (I:L) and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:34 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Installed Base accessible data as well as unauthorized update, insert or delete access to some of Oracle Installed Base accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).

AnalysisAI

Unauthorized data access in Oracle Installed Base (a module of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a low-privileged, network-based attacker read all data accessible to the Installed Base application and modify some of it via HTTP. Oracle rates it CVSS 7.1, driven by high confidentiality impact and partial integrity impact with no availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it is disclosed as part of the Oracle July 2026 Critical Patch Update.

Technical ContextAI

Oracle Installed Base is an asset-lifecycle-tracking application within the Oracle E-Business Suite (EBS) applications tier, which runs on Oracle Application Server / Oracle HTTP Server and is accessed over HTTP by authenticated business users. The flaw is in the 'Create Item Instance' component. No CWE was assigned in the source data, but the described behavior - a low-privileged user gaining access to data beyond their authorization scope and being able to insert/update/delete some records - is consistent with a broken access control / improper authorization weakness (CWE-285-class), notwithstanding the input's 'Authentication Bypass' tag, which is not fully consistent with the CVSS PR:L (privileges required) metric. The affected component is server-side EBS application code shared across the 12.2.x release line; no CPE strings were provided in the intelligence, so exact platform enumeration relies on Oracle's own version list.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update, which contains the fix for this issue; consult https://www.oracle.com/security-alerts/cpujul2026.html and apply the specific patch listed there for Oracle E-Business Suite 12.2 (Patch available per vendor advisory - Oracle does not publish a separate point-release version number, so cite the CPU patch level rather than an invented version). No exact standalone fix version was provided in the input, so identify the correct patch by cross-referencing your EBS 12.2.x patchset in the CPU advisory. Until patched, reduce exposure by restricting network access to the Oracle Installed Base / EBS application endpoints - for example placing the EBS applications tier behind VPN or IP allow-listing and removing any direct internet exposure of the Installed Base responsibilities - and review and tighten EBS responsibility/menu assignments so low-privileged accounts cannot reach the 'Create Item Instance' function; the trade-off is that URL-firewalling and responsibility hardening can block legitimate remote users and integrations, so test against business workflows before enforcing. Monitor EBS access logs for anomalous Installed Base data access by low-privilege accounts as a detective control.