What is the CVSS score of CVE-2026-60945?

CVE-2026-60945 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Learning Management are affected by CVE-2026-60945?

Oracle Learning Management in E-Business Suite versions 12.2.3-12.2.15 contains a vulnerability allowing authenticated users with low privileges to compromise all accessible organizational data…

How to fix or mitigate CVE-2026-60945?

Within 24 hours: Identify all Oracle E-Business Suite deployments running Learning Management versions 12.2.3 through 12.2.15 and inventory business-critical data stored in these systems. Within 7 days: Implement application-level access controls to restrict low-privileged user permissions within the Learning Management module, disable or restrict bulk data export capabilities, and enhance email and communication security to reduce susceptibility to social engineering. Within 30 days: Contact Oracle for patch availability and security updates; evaluate feasibility of upgrading to unaffected versions or implementing network segmentation to limit access to Oracle Learning Management systems to authorized internal users only.

Oracle Learning Management CVE-2026-60945

EUVD-2026-47206 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-p8qm-6w8x-w97w

Authentication Bypass Oracle Learning Management

7.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

7.3 HIGH

Network HTTP reachable and low-complexity, but needs an authenticated low-privileged account (PR:L) and a separate victim's interaction (UI:R); high confidentiality/integrity, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:27 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.3

DescriptionCVE.org

Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Learning Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Learning Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Learning Management accessible data. CVSS 3.1 Base Score 7.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Learning Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read, create, delete, or modify all data accessible to the application after luring a victim into interacting. Rated CVSS 3.1 7.3 (High) with full confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the required user interaction moderates raw exploitability.

Technical ContextAI

Oracle Learning Management (OLM) is an enterprise learning/training module within Oracle E-Business Suite (EBS), a large ERP platform accessed over HTTP through a browser-based front end. The affected component is 'Internal Operations,' and Oracle's own tagging associates this issue with an authentication bypass class of weakness (no CWE was supplied in the feed, so the exact weakness type is not formally classified). The CVSS vector (AV:N/AC:L/PR:L/UI:R) indicates a web-facing flaw reachable over HTTP that a low-privileged EBS user can trigger, with the twist that the payload lands against another user who must interact - a pattern consistent with cross-user request handling or session/authorization abuse in the web tier rather than a memory-safety bug. No CPE strings were provided in this feed, so exact affected configurations are drawn from the EUVD/Oracle version range.

RemediationAI

Apply the fixes delivered in Oracle's Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships EBS security fixes as bundled CPU patches per release level rather than as a single named version, so identify and apply the OLM/EBS 12.2.x patch listed in that CPU for your exact patchset - no discrete standalone fix-version string was provided in this data. Because exploitation needs an authenticated low-privileged user plus victim interaction, interim compensating controls while you schedule the CPU include: restrict OLM access to trusted internal networks or VPN and remove any internet exposure of the EBS web tier (trade-off: reduces reach for legitimate remote/external learners); tighten OLM responsibilities/roles to the least privilege needed and audit low-privileged accounts (trade-off: administrative overhead and possible user friction); and enforce user-awareness controls to reduce the likelihood victims act on attacker-supplied links/requests. Do not rely on these as a permanent substitute for the CPU patch.