What is the CVSS score of CVE-2026-60917?

CVE-2026-60917 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60917?

Oracle E-Business Suite Inventory Management (versions 12.2.3-12.2.15) contains a critical data access vulnerability allowing any low-privilege, authenticated user to bypass authorization controls…

How to fix or mitigate CVE-2026-60917?

Within 24 hours: Inventory all systems running Oracle EBS versions 12.2.3-12.2.15 and assess who has network access to the Inventory Management module; contact Oracle support immediately regarding patch availability and release timeline. Within 7 days: Implement network-level access controls restricting Inventory Management module access to specific authorized users and service accounts; enable comprehensive access logging and audit all user activity in the module for unauthorized data changes. Within 30 days: Develop and execute a remediation plan including either: (a) deploying a vendor patch when released by Oracle, or (b) if patch remains unavailable or upgrade is not feasible, implement compensating controls including application-level role-based access restrictions, database encryption at rest, and continuous access auditing.

Oracle E-Business Suite CVE-2026-60917

EUVD-2026-47184 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-4x37-644q-76x6

Authentication Bypass Oracle Inventory Management

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reachable with low complexity, but a valid low-privilege EBS session is required (PR:L); high confidentiality and integrity impact, no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:34 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite (component: Core Receiving). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Inventory Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Inventory Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Inventory Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle E-Business Suite Inventory Management (Core Receiving component, versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read, create, delete or modify all data accessible to the Inventory Management module over HTTP. The flaw is rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, and is trivially exploitable (AC:L) once the attacker holds any valid low-privilege EBS session. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the 'Authentication Bypass' tag suggests the flaw may let a low-privilege account reach functionality or data it should not.

Technical ContextAI

Oracle E-Business Suite is a large enterprise ERP/business-application suite; the affected piece is the Inventory Management product, specifically the Core Receiving component that handles inbound goods receipt transactions. EBS is a web-tier (Oracle HTTP Server / WebLogic / mod_pls) application fronting an Oracle Database, and vulnerabilities here typically arise from insufficient authorization checks on servlet/JSP or PL/SQL endpoints reachable by authenticated users. Oracle did not assign a CWE (CWE: N/A), but the vendor 'Authentication Bypass' tag combined with the CVSS profile (confidentiality and integrity impact, low privileges required) points to a broken-access-control / missing-authorization class of defect (conceptually CWE-862/CWE-863), where a low-privilege session can invoke Core Receiving operations that expose or alter data beyond its intended scope.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships EBS security fixes as CPU patch bundles rather than a single renamed product version, so identify and apply the specific CPU patch for your 12.2.x release level via My Oracle Support - no discrete fixed version string was provided in the input, so treat 'Patch available per vendor advisory (Oracle CPU July 2026)' as the patch status and do not assume a version number. Until the CPU is applied, reduce exposure by restricting network access to the EBS web tier and Core Receiving endpoints to trusted internal networks/VPN, tightening EBS user provisioning and responsibilities so low-privilege accounts cannot reach Inventory Management functions they do not need, and monitoring for anomalous receiving/inventory transactions and access to critical data; these controls limit reachability and blast radius but do not remove the underlying flaw, and endpoint restrictions may disrupt legitimate remote or integrated users of the receiving workflow. Because the vector requires only a low-privilege authenticated session, credential hygiene (MFA on EBS logins, rotating shared accounts) is a meaningful compensating control.