What is the CVSS score of CVE-2026-60982?

CVE-2026-60982 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60982?

CVE-2026-60982 exposes federal HR data in Oracle E-Business Suite (versions 12.2.3-12.2.15) to unauthorized modification and disclosure by network attackers.

How to fix or mitigate CVE-2026-60982?

Within 24 hours: Inventory all Oracle E-Business Suite deployments in versions 12.2.3 through 12.2.15 across the organization and review access logs for suspicious activity targeting the HR module. Within 7 days: Apply Oracle Critical Patch Update (July 2026) to all affected systems, prioritizing production federal deployments first. Within 30 days: Conduct HR data integrity audit to detect any unauthorized modifications, implement enhanced monitoring and alerting on the HR module, and validate all security controls post-patch deployment.

Oracle E-Business Suite CVE-2026-60982

EUVD-2026-47224 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-62cc-c9gx-5m9r

Authentication Bypass Oracle E Business Suite

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP access with an authenticated low-privilege session (PR:L, AV:N, AC:L, UI:N); high confidentiality and integrity impact on module data, no availability impact and no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:19 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle US Federal Human Resources product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle US Federal Human Resources. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle US Federal Human Resources accessible data as well as unauthorized access to critical data or complete access to all Oracle US Federal Human Resources accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthorized read and write access to Oracle US Federal Human Resources (the Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-based attacker over HTTP, with no user interaction. Successful exploitation lets the attacker view, create, delete, or modify all data accessible to the module, carrying a CVSS 3.1 base score of 8.1 (high confidentiality and integrity impact, no availability impact). Fixed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

The affected software is Oracle E-Business Suite, Oracle's integrated enterprise resource planning (ERP) suite, and specifically the Oracle US Federal Human Resources product used by US federal agencies for personnel and HR administration. The flaw resides in the 'Internal Operations' component and is exposed over the standard HTTP application interface. Oracle assigned no CWE (CWE: N/A), but the third-party 'Authentication Bypass' tag combined with the CVSS PR:L metric suggests a broken access-control / authorization weakness where an already-authenticated low-privilege session can reach data and operations it should not be permitted to touch, rather than a fully unauthenticated bypass. No CPE strings were provided in the intelligence; affected products are identified only from the Oracle CPU text and the ENISA EUVD record.

RemediationAI

Patch available per vendor advisory: apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html), which is the primary and recommended remediation; an exact standalone fixed build number was not published in the supplied data beyond the CPU itself, so consult the advisory for the specific patch for your EBS 12.2.x level. Until the CPU is applied, reduce exposure by restricting network reachability of the E-Business Suite HTTP endpoints to trusted networks/VPN, tightening access so only necessary low-privilege accounts can reach the Internal Operations / Federal HR functions, and increasing monitoring of HR data create/modify/delete activity - noting the trade-off that network restrictions may impede legitimate remote users and that access tightening requires validated role review to avoid breaking workflows. Because exploitation needs an authenticated low-privilege session, auditing and pruning unnecessary EBS accounts is a meaningful compensating control.