What is the CVSS score of CVE-2026-60924?

CVE-2026-60924 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60924?

Compromised payroll operations pose critical risk to wage processing and employee data.

How to fix or mitigate CVE-2026-60924?

Within 24 hours: audit all Oracle E-Business Suite instances to identify those running versions 12.2.3 through 12.2.15 and notify payroll operations and compliance teams of exposure. Within 7 days: restrict network access to the Public Sector Payroll module to essential personnel and systems only, enforce multi-factor authentication for all accounts with payroll module access, and enable detailed audit logging on payroll transactions. Within 30 days: contact Oracle support to track patch availability for CVE-2026-60924, develop and lab-test an upgrade path to a patched version once released, and document all access restrictions as interim compensating controls.

Oracle E-Business Suite CVE-2026-60924

EUVD-2026-47190 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-75jr-v622-w743

Oracle Privilege Escalation E Business Suite

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote HTTP, low complexity, no interaction, but a valid low-privileged EBS account is required (PR:L); full module takeover gives C:H/I:H/A:H with scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:31 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Public Sector Payroll. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover in the Public Sector Payroll module (Internal Operations component) of Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged attacker with network HTTP access fully compromise the payroll application. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and calls it 'easily exploitable,' meaning a single low-tier authenticated account is enough to seize the module. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and network reach make it a prompt-patch item from the July 2026 Critical Patch Update.

Technical ContextAI

Oracle E-Business Suite is a large web-based ERP platform; the affected piece is the Public Sector Payroll product, specifically its Internal Operations component, which handles government and public-sector payroll processing. The vulnerability is reached over HTTP through the EBS web tier, consistent with the servlet/mod_plsql front-end that exposes application functions to authenticated users. Oracle assigned no CWE (CWE: N/A) and withholds root-cause detail per its Critical Patch Update disclosure policy, but the C:H/I:H/A:H 'takeover' outcome from a low-privileged position is characteristic of a broken access control or injection flaw enabling privilege escalation within the module, rather than a pure information-disclosure bug despite the 'Information Disclosure' tag.

RemediationAI

Apply the fixes in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Patch available per vendor advisory, though Oracle does not publish a standalone fixed build number and the fix ships as the quarterly CPU bundle for EBS 12.2.x, so identify and apply the specific patch listed in that CPU for your 12.2.3-12.2.15 release. Because exploitation requires a low-privileged account, compensating controls until patching completes include restricting network access to the EBS web tier to trusted internal segments and VPN users only, tightening and auditing EBS user provisioning to remove unnecessary low-tier accounts, and placing a WAF or reverse proxy in front of the Payroll/Internal Operations endpoints to log and rate-limit access - with the trade-off that these reduce but do not eliminate risk for legitimate authenticated users and may disrupt integrations relying on those endpoints. Do not deploy invented version numbers; rely on the CPU patch mapping for your exact release.