What is the CVSS score of CVE-2026-60926?

CVE-2026-60926 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60926?

Oracle E-Business Suite Public Sector Payroll module versions 12.2.3-12.2.15 contains a critical flaw enabling complete takeover of payroll operations and exposure of employee financial data.

How to fix or mitigate CVE-2026-60926?

Within 24 hours, audit all deployments to identify instances of Oracle E-Business Suite payroll module versions 12.2.3 through 12.2.15 in production and document current access controls and privilege assignments. Within 7 days, implement network segmentation to restrict HTTP access to the payroll module to authorized administrative networks only, enforce multi-factor authentication for all high-privilege payroll system accounts, and enable comprehensive audit logging of payroll module access and data modifications. Within 30 days, monitor Oracle advisories for patch availability and establish a staged deployment plan; implement privileged access management controls to limit and monitor high-privilege account usage; and conduct privilege reviews to identify and remove unnecessary elevated access.

Oracle E-Business Suite CVE-2026-60926

EUVD-2026-47192 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-v2hp-pw45-6v4p

Authentication Bypass Oracle E Business Suite

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network HTTP-reachable and low-complexity with no user interaction, but Oracle states a high-privileged attacker is required, so PR:H; full takeover gives C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:31 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Public Sector Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Public Sector Payroll. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of the Oracle Public Sector Payroll module (Internal Operations component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible for a high-privileged attacker with network HTTP access, yielding complete takeover of the payroll application per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score is 7.2 with high confidentiality, integrity, and availability impact, but exploitation requires existing high-level privileges (PR:H). There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Technical ContextAI

Oracle E-Business Suite (EBS) is Oracle's integrated enterprise resource planning (ERP) application suite; the affected Public Sector Payroll module handles government/public-sector payroll processing and is exposed over HTTP through the EBS web/application tier. The vulnerable 'Internal Operations' component is reachable via network HTTP requests. No CWE was assigned (CWE: N/A), so the precise root-cause class is not published by Oracle, which is typical for Oracle CPU advisories that withhold technical detail; the vendor tag 'Information Disclosure' is included but the CVSS impact triad (C:H/I:H/A:H) and Oracle's 'takeover' language point to a broader privilege-abuse or logic/injection flaw rather than pure disclosure.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory; a discrete fixed version string was not provided in the input, so map your EBS 12.2.x release to the corresponding CPU patch set on My Oracle Support. Because exploitation requires high privileges, compensating controls until patching completes include tightly restricting and auditing high-privilege EBS/Payroll accounts, enforcing least privilege and strong authentication (MFA) on those accounts, and limiting network HTTP access to the EBS application tier to trusted management networks or via VPN/allowlist (trade-off: may disrupt legitimate remote administrative or integration access). Monitor payroll-module and Internal Operations activity logs for anomalous privileged actions. Do not rely solely on the vendor 'Information Disclosure' tag when prioritizing - treat it as a full takeover per the CVSS impact.