What is the CVSS score of CVE-2026-60952?

CVE-2026-60952 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Transportation Execution are affected by CVE-2026-60952?

Oracle Transportation Execution (CVSS 8.8) is vulnerable to complete compromise by any authenticated user; while no public exploit has been identified, this poses significant risk to supply chain…

How to fix or mitigate CVE-2026-60952?

Within 24 hours, restrict network access to Oracle Transportation Execution module to essential authorized users only and enable comprehensive access logging. Within 7 days, audit all OTA user accounts, deactivate unnecessary accounts, and implement multi-factor authentication for all remaining users. Within 30 days, deploy Oracle's July 2026 Critical Patch Update immediately upon availability to remediate the vulnerability.

Oracle Transportation Execution CVE-2026-60952

EUVD-2026-47210 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-r4x3-86f4-wrf8

Oracle Privilege Escalation E Business Suite

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reachable with low complexity and no interaction, but a valid low-privilege EBS account is required (PR:L); module takeover yields full C/I/A impact in unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:25 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Transportation Execution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Transportation Execution. Successful attacks of this vulnerability can result in takeover of Oracle Transportation Execution. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Transportation Execution (a module of Oracle E-Business Suite, Internal Operations component) is possible for a low-privileged attacker with only network HTTP access to the application. Any authenticated user account can be leveraged to fully compromise confidentiality, integrity, and availability of the module, per the CVSS 3.1 8.8 vector. No public exploit identified at time of analysis; the fix ships in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Transportation Execution is part of the Oracle E-Business Suite (EBS) ERP platform, delivered through the Internal Operations component and typically fronted by the EBS Oracle HTTP Server / Application Object Library (AOL) web tier. Because the vulnerability is reachable over HTTP by an authenticated low-privilege user and yields complete takeover of the module, the root cause is consistent with an application-layer authorization or injection weakness in an EBS servlet/JSP endpoint, though Oracle does not disclose the specific mechanism (CWE is not published - CWE: N/A). The affected code spans the EBS 12.2 release train (12.2.3 through 12.2.15), meaning the flaw exists in the shared 12.2 codebase rather than a single point release.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update (CPU), which contains the fix for this issue, per https://www.oracle.com/security-alerts/cpujul2026.html - Patch available per vendor advisory; Oracle does not publish a standalone fixed version string separate from the CPU, so treat the July 2026 CPU as the required update for EBS 12.2.x. Oracle CPUs are cumulative, so install the latest available EBS 12.2 CPU bundle rather than an isolated patch. Until the CPU can be applied, compensating controls include restricting network reachability of the Transportation Execution / Internal Operations endpoints to trusted internal segments and VPN users (limits AV:N exposure at the cost of blocking legitimate remote users), tightening EBS user provisioning and reviewing which low-privilege accounts can reach the module (reduces the PR:L attack surface but does not remove the flaw), and enabling WAF/URL-firewall rules and enhanced logging in front of the EBS web tier to detect anomalous requests. These are stopgaps only; none substitute for the CPU.