What is the CVSS score of CVE-2026-60963?

CVE-2026-60963 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Treasury are affected by CVE-2026-60963?

Oracle Treasury in E-Business Suite versions 12.2.3-12.2.15 contains a data manipulation vulnerability allowing authenticated network users to read, delete, or alter all Treasury records.

How to fix or mitigate CVE-2026-60963?

Within 24 hours, enumerate all Oracle E-Business Suite systems running Treasury versions 12.2.3 through 12.2.15 and review current patch status against the July 2026 Oracle Critical Patch Update. While no public exploit identified at time of analysis, organizations should prioritize applying the July 2026 CPU to all unpatched instances within 7 days to address this high-impact vulnerability. Within 30 days, conduct Treasury module testing to validate normal operations post-patch and audit access logs from the pre-patch window for any unauthorized data access.

Oracle Treasury CVE-2026-60963

EUVD-2026-47216 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-598r-x58x-9c8g

Authentication Bypass Oracle E Business Suite

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP-reachable with low complexity and no user interaction, but requires an existing low-privileged EBS account (PR:L); high confidentiality/integrity impact and no availability effect (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:23 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Treasury product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Treasury. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Treasury accessible data as well as unauthorized access to critical data or complete access to all Oracle Treasury accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Treasury (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read, create, delete, or modify all Treasury-accessible data over HTTP. Oracle rates it CVSS 3.1 8.1 (high confidentiality and integrity impact, no availability impact), and it is addressed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Treasury is the cash- and risk-management module of Oracle E-Business Suite (EBS), Oracle's on-premises ERP platform, and the flaw sits in its Internal Operations component. EBS is a web-tier application (Oracle Application Server / WebLogic fronting a database), so 'network access via HTTP' means the attacker reaches the standard EBS web front end. The vendor tag labels this an 'Authentication Bypass,' but the CVSS vector requires PR:L (an existing low-privileged account), so the more precise reading is a broken-access-control / authorization flaw (CWE class akin to CWE-284/CWE-863 Improper Authorization) that lets a low-privileged user reach data and operations they should not - Oracle does not publish a CWE for this CVE, so the exact root-cause class is unconfirmed.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Patch available per vendor advisory, though Oracle CPUs ship as cumulative patch bundles rather than a single named Treasury version, so identify and apply the specific EBS 12.2 patch listed for your release level (12.2.3-12.2.15). Until patching, reduce exposure by restricting network reachability of the EBS web tier to trusted internal users/VPN rather than the public internet, tightening Treasury responsibility/role assignments so only necessary low-privileged accounts exist, and increasing monitoring/audit of Treasury data changes - the trade-off is that these are compensating controls only and do not close the authorization flaw, which requires the CPU patch. Do not rely on the 'Authentication Bypass' tag to assume network segmentation alone is sufficient, since the vector indicates an already-authenticated low-privileged user can trigger it.