What is the CVSS score of CVE-2026-60920?

CVE-2026-60920 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Customer Care are affected by CVE-2026-60920?

Oracle E-Business Suite Customer Care module (versions 12.2.3-12.2.15) is vulnerable to authenticated account takeover, enabling low-privileged users to fully compromise the module's confidentiality,…

How to fix or mitigate CVE-2026-60920?

Within 24 hours, inventory all Oracle E-Business Suite deployments to identify instances running versions 12.2.3 through 12.2.15, particularly those with Customer Care module enabled. Within 7 days, obtain the July 2026 Critical Patch Update from Oracle's security updates portal and schedule deployment windows across non-production environments for validation. Within 30 days, deploy the July 2026 CPUa to all affected production instances and confirm successful patching; in the interim, enforce IP-based access restrictions to the Customer Care module and review user privilege assignments to eliminate unnecessary low-privilege user accounts with HTTP access.

Customer Care CVE-2026-60920

EUVD-2026-47187 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-m65p-2xff-vv87

Privilege Escalation Oracle Customer Care

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:33 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Customer Care. Successful attacks of this vulnerability can result in takeover of Oracle Customer Care. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account/component takeover in the Oracle Customer Care module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15) allows a low-privileged, authenticated attacker with HTTP network access to fully compromise the Customer Care component. The flaw carries a CVSS 3.1 base score of 8.8 with high confidentiality, integrity, and availability impact, and low attack complexity. It was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.