What is the CVSS score of CVE-2026-60925?

CVE-2026-60925 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of E Business Suite are affected by CVE-2026-60925?

CVE-2026-60925 affects Oracle E-Business Suite (EBS) versions 12.2.4-12.2.15, enabling complete compromise of the Public Sector Payroll module for authenticated users with high-privilege access.

How to fix or mitigate CVE-2026-60925?

Within 24 hours, identify all EBS instances running versions 12.2.4-12.2.15 and determine their network exposure and privilege access model. Within 7 days, enforce network segmentation to restrict HTTP access to administrative networks only, implement multi-factor authentication for all high-privilege EBS accounts, enable detailed logging on payroll module access, and audit privileged user activity for unauthorized changes. Within 30 days, establish communication with Oracle to confirm patch availability timelines, plan a controlled upgrade or migration strategy, and conduct a security assessment of all privileged user accounts.

E Business Suite CVE-2026-60925

EUVD-2026-47191 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-c7jx-f5mf-jjx2

Oracle Privilege Escalation E Business Suite

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:31 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.4-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Public Sector Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Public Sector Payroll. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of the Oracle Public Sector Payroll module within Oracle E-Business Suite (Internal Operations component) is possible for an already-privileged attacker who can reach the application over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw affects supported EBS releases 12.2.4 through 12.2.15 and, though rated CVSS 7.2, requires high existing privileges (PR:H), which narrows the realistic attacker set to trusted or authenticated users. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.