What is the CVSS score of CVE-2026-60932?

CVE-2026-60932 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of E Business Suite are affected by CVE-2026-60932?

Oracle Labor Distribution (E-Business Suite) is vulnerable to full account takeover affecting versions 12.2.3-12.2.15; authenticated users with low privileges can compromise confidentiality,…

How to fix or mitigate CVE-2026-60932?

Within 24 hours, inventory all Oracle E-Business Suite systems running versions 12.2.3-12.2.15 and implement firewall rules restricting Labor Distribution module access to authenticated users from predefined trusted networks only; review access logs for suspicious HTTP requests to the module. Within 7 days, contact Oracle Support for patching timeline and interim security guidance, deploy network micro-segmentation isolating Labor Distribution, and implement continuous monitoring for authentication failures and anomalous transaction activity. Within 30 days, apply vendor-released patch immediately upon Oracle's release, validate access controls post-patch, and consider implementing multi-factor authentication if your E-Business Suite configuration supports it.

E Business Suite CVE-2026-60932

EUVD-2026-47197 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-f9m2-x3g4-jh28

Oracle Privilege Escalation E Business Suite

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:29 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Labor Distribution. Successful attacks of this vulnerability can result in takeover of Oracle Labor Distribution. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full account takeover of Oracle Labor Distribution (part of Oracle E-Business Suite, Internal Operations component) is possible when a low-privileged attacker sends crafted HTTP requests to affected servers running versions 12.2.3 through 12.2.15. The flaw compromises confidentiality, integrity, and availability of the module and, per Oracle, results in complete takeover of Labor Distribution. No public exploit identified at time of analysis, though the CVSS 8.8 rating and network-reachable, low-complexity nature make it a high-priority patch in the Oracle July 2026 Critical Patch Update.