Customer Care CVE-2026-60920

Oracle E-Business Suite Customer Care module (versions 12.2.3-12.2.15) is vulnerable to authenticated account takeover, enabling low-privileged users to fully compromise the module's confidentiality, integrity, and availability. Organizations using affected EBS versions face unauthorized access to customer data and potential service disruption of their customer-facing operations.

Within 24 hours, inventory all Oracle E-Business Suite deployments to identify instances running versions 12.2.3 through 12.2.15, particularly those with Customer Care module enabled. Within 7 days, obtain the July 2026 Critical Patch Update from Oracle's security updates portal and schedule deployment windows across non-production environments for validation. Within 30 days, deploy the July 2026 CPUa to all affected production instances and confirm successful patching; in the interim, enforce IP-based access restrictions to the Customer Care module and review user privilege assignments to eliminate unnecessary low-privilege user accounts with HTTP access.

Apply vendor patch (July 2026 Critical Patch Update). If patch deployment is delayed: restrict HTTP network access to the Customer Care module to essential business IP ranges and users; audit and reduce low-privileged user account permissions to the minimum required; implement monitoring of Customer Care module authentication events for anomalous account access patterns.