What is the CVSS score of CVE-2026-60966?

CVE-2026-60966 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60966?

Oracle E-Business Suite Public Sector Human Resources module (versions 12.2.3-12.2.15) contains a critical data compromise flaw allowing authenticated network attackers to read, create, delete, or…

How to fix or mitigate CVE-2026-60966?

Within 24 hours, inventory all Oracle EBS systems and identify instances running affected releases 12.2.3 through 12.2.15; assess network exposure and review access logs for suspicious activity involving HR module access. Within 7 days, restrict network access to EBS systems to required users and locations only, enforce multi-factor authentication at the application level where available, and disable or restrict elevated permissions for HR data access; implement real-time logging and monitoring of HR data modifications. Within 30 days, prepare an upgrade plan to releases beyond 12.2.15, establish a vendor communication channel to receive patch release timeline notifications, and conduct a forensic review of HR data modifications and access logs covering the past 90 days to identify any unauthorized changes.

Oracle E-Business Suite CVE-2026-60966

EUVD-2026-47218 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-jrh3-7gg5-3hcq

Authentication Bypass Oracle E Business Suite

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reachable (AV:N), low complexity (AC:L), requires a low-privilege account (PR:L), no user interaction; high confidentiality and integrity but no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:22 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite (component: Regression Testing). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Human Resources. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Public Sector Human Resources accessible data as well as unauthorized access to critical data or complete access to all Oracle Public Sector Human Resources accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in the Oracle Public Sector Human Resources module of Oracle E-Business Suite (Regression Testing component) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify any data accessible to the application. The flaw affects EBS releases 12.2.3 through 12.2.15 and carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but as an internet-facing Oracle EBS component it is a plausible target once the July 2026 CPU details are studied.

Technical ContextAI

Oracle E-Business Suite is a large PL/SQL and Java-based enterprise resource planning platform; the affected code lives in the Public Sector Human Resources application under the 'Regression Testing' component. The vulnerability is exposed over HTTP through the EBS web tier, meaning it is reachable by any user who can authenticate to the application. Oracle did not assign a CWE (CWE: N/A) and did not publish a detailed root-cause class, though the third-party tag 'Authentication Bypass' suggests the flaw may permit an already-authenticated low-privilege account to escalate its data reach beyond its intended authorization boundary. The CVSS vector (AV:N/AC:L/PR:L/UI:N, S:U, C:H/I:H/A:N) indicates a network-facing, low-complexity issue that leaks and corrupts data within the same security scope without affecting availability.

RemediationAI

Patch available per vendor advisory: apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the primary and recommended remediation for all EBS 12.2.3-12.2.15 installations; no standalone fixed version string was published in the source data, so identify the exact patch for your release from the CPU matrix. Because exploitation requires HTTP access with a low-privileged account, effective compensating controls until patching include restricting EBS web-tier exposure so the application is not reachable from the public internet (place it behind VPN or an allowlisted reverse proxy), tightening account provisioning and review of low-privilege/self-service accounts, and monitoring HR data access for anomalous create/delete/modify activity - the trade-off is that network restrictions may break legitimate remote self-service users and should be scoped to preserve required workflows. Verify the vendor's advisory for any component-specific prerequisites before relying on workarounds.