What is the CVSS score of CVE-2026-60910?

CVE-2026-60910 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Property Manager are affected by CVE-2026-60910?

Oracle Property Manager (E-Business Suite, versions 12.2.3-12.2.15) allows authenticated high-privilege users to completely compromise the component, affecting data integrity and operational…

How to fix or mitigate CVE-2026-60910?

Within 24 hours: identify all Oracle EBS systems running versions 12.2.3-12.2.15 and audit high-privilege user accounts with Property Manager access; immediately remove unnecessary high-privilege credentials. Within 7 days: enforce multi-factor authentication on all remaining high-privilege accounts, restrict Property Manager network access to defined trusted internal IPs, and enable detailed audit logging for all administrative actions. Within 30 days: monitor Oracle support channels for patch release; establish a testing plan for the patched version in non-production environments; schedule production deployment upon patch availability.

Oracle Property Manager CVE-2026-60910

EUVD-2026-47180 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-9grh-4c28-v38h

Authentication Bypass Oracle Property Manager

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Description confirms network HTTP access and a high-privileged attacker (PR:H) achieving full takeover, so AV:N/AC:L with C/I/A all High and no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:34 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Property Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Property Manager. Successful attacks of this vulnerability can result in takeover of Oracle Property Manager. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Property Manager (a module of Oracle E-Business Suite) is possible for a high-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation yields complete takeover of the Property Manager component with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though Oracle rates it easily exploitable once the required privileges are held.

Technical ContextAI

Oracle Property Manager is the real-estate and lease administration module within Oracle E-Business Suite, running on the EBS application tier and reached over HTTP through the EBS web interface (the affected code lives in the 'Internal Operations' component). Because it is part of the tightly integrated EBS/Applications framework, a compromise of the module can expose the underlying application schema and business data it manages. No CWE was assigned by Oracle (CWE: N/A), so the precise root-cause class (e.g., injection, access-control flaw, or deserialization) cannot be confirmed from the provided data; Oracle's advisory practice discloses only the component and impact, not the technical weakness.

RemediationAI

Patch available per vendor advisory: apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to all EBS 12.2.3-12.2.15 instances; Oracle does not publish a standalone fixed version number, so the CPU bundle is the release to apply. No exact fixed build was provided in the input, so confirm the specific patch numbers for your EBS 12.2.x level directly in the CPU advisory. Until the CPU can be applied, reduce exposure by tightly restricting which accounts hold the high privileges the attack requires (review Property Manager and Internal Operations responsibility/role assignments and remove unneeded grants), and limit network reachability of the EBS web tier to trusted internal users via network segmentation or VPN - the trade-off being that over-restricting responsibilities or network paths can disrupt legitimate lease-administration workflows, so validate changes against business use before enforcing.