What is the CVSS score of CVE-2026-60923?

CVE-2026-60923 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60923?

Oracle E-Business Suite Capacity module (versions 12.2.3-12.2.15) exposes sensitive operational data to low-privilege users, potentially affecting connected business systems.

How to fix or mitigate CVE-2026-60923?

While no public exploit code has been identified at time of analysis, the low barrier to exploitation requires prompt action. Within 24 hours, identify all systems running Oracle E-Business Suite versions 12.2.3 through 12.2.15 and audit recent access logs for suspicious activity in the Capacity module. Within 7 days, apply the Oracle July 2026 Critical Patch Update to all affected instances, starting with test environments. Within 30 days, complete production patching and conduct a full data access audit to identify any unauthorized disclosures that occurred during the vulnerability window.

Oracle E-Business Suite CVE-2026-60923

EUVD-2026-47189 HIGH

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-3vg3-66vr-j2wj

Authentication Bypass Information Disclosure Oracle Capacity

7.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network HTTP reach with low-privilege account (AV:N/AC:L/PR:L/UI:N); authorization bypass crossing security scope (S:C) yields high confidentiality loss with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:32 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.7

DescriptionCVE.org

Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity. While the vulnerability is in Oracle Capacity, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Capacity accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle E-Business Suite's Oracle Capacity module (Internal Operations component), versions 12.2.3 through 12.2.15, allows a low-privileged attacker with HTTP network access to read all Oracle Capacity-accessible data and, due to a scope change, impact additional connected products. The flaw is easily exploitable and requires only a low-privilege account, no user interaction. It is addressed in Oracle's July 2026 Critical Patch Update; no public exploit has been identified at time of analysis.

Technical ContextAI

Oracle Capacity is a supply-chain/manufacturing planning module of the Oracle E-Business Suite (EBS) ERP platform, exposed over HTTP through the EBS application tier. The vulnerability sits in the Internal Operations component and is tagged by the reporter as an authentication/authorization bypass, permitting a low-privileged user to reach data beyond their intended authorization boundary. No CWE was assigned by NVD, but the confidentiality-only, scope-changing profile combined with the 'Authentication Bypass' tag is consistent with a broken access-control / improper authorization class of weakness (e.g., CWE-284/CWE-639-style horizontal or vertical privilege issues). The scope change (S:C) indicates the vulnerable Capacity component can be leveraged to affect data managed by other EBS components sharing the same security authority.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (CPU) for E-Business Suite 12.2, referenced at https://www.oracle.com/security-alerts/cpujul2026.html - Patch available per vendor advisory; an exact standalone fix version is not enumerated in the provided data, so identify and apply the specific CPU patch level for your 12.2.x release (12.2.3-12.2.15). Until patched, apply compensating controls: restrict HTTP access to the Oracle Capacity / Internal Operations pages to trusted internal networks via URL firewall / reverse-proxy rules (trade-off: may break legitimate remote planner access), tighten EBS responsibility and menu assignments to remove Capacity access from users who do not require it (reducing the pool of low-privileged accounts that meet PR:L), and increase auditing/monitoring of Capacity data access for anomalous reads. Because impact is confidentiality-only with a scope change, prioritize segmenting the affected EBS instance from other sensitive systems it shares authority with.