What is the CVSS score of CVE-2026-60989?

CVE-2026-60989 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Advanced Collections are affected by CVE-2026-60989?

Oracle Advanced Collections within E-Business Suite contains a critical vulnerability (CVE-2026-60989, CVSS 8.8) allowing complete module compromise by low-privileged network attackers.

How to fix or mitigate CVE-2026-60989?

Within 24 hours, inventory all systems running Oracle Advanced Collections and restrict network access to the affected component to authorized users only; contact Oracle support immediately to confirm patch timeline and availability. Within 7 days, implement network segmentation to isolate Advanced Collections from untrusted networks, enforce multi-factor authentication for all user accounts accessing the module, and enable detailed transaction-level audit logging. Within 30 days, establish a monitoring process for Oracle's Critical Patch Update releases, prepare a deployment plan for when patches become available, and conduct weekly scans to detect unauthorized access attempts on the isolated module.

Oracle Advanced Collections CVE-2026-60989

EUVD-2026-47230 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-vrc8-r74g-rhjv

Privilege Escalation Oracle Advanced Collections

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

HTTP-reachable EBS module (AV:N) exploitable by an authenticated low-privileged user (PR:L) with no interaction and low complexity, yielding full module takeover (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:16 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Advanced Collections product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Collections. Successful attacks of this vulnerability can result in takeover of Oracle Advanced Collections. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Advanced Collections (Internal Operations component of Oracle E-Business Suite) is achievable by a low-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. Rated CVSS 3.1 8.8, successful exploitation yields complete takeover of the module with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and single-privilege prerequisite make it a strong patching priority.

Technical ContextAI

Oracle Advanced Collections is a delinquency- and collections-management module within the Oracle E-Business Suite (EBS) ERP platform, exposed over HTTP through EBS's Java/Oracle Application Framework web tier. The affected 'Internal Operations' component handles collections processing logic that is reachable by authenticated EBS application users. No CWE was assigned by NVD, so the precise root-cause class (e.g., injection, access-control bypass, or deserialization) is not specified in the available data; the vendor tag 'Information Disclosure' and the described 'takeover' outcome together imply a flaw that escalates a limited application session into full control of the module. Exact affected products are Oracle Advanced Collections versions 12.2.3 through 12.2.15; no CPE strings were provided in the intelligence feed.

RemediationAI

Apply the fixes delivered in Oracle's Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); patch available per vendor advisory, though a discrete fix build number is not enumerated in the available data - consult the CPU patch matrix for the exact EBS 12.2 patch corresponding to your version. Because exploitation requires an authenticated low-privileged session, interim compensating controls until patching include restricting network access to the EBS web tier so Advanced Collections URLs are reachable only from trusted internal segments or via VPN (trade-off: may disrupt remote collections staff), tightening EBS user provisioning and removing unused low-privilege accounts to shrink the pool of usable sessions, and enabling enhanced logging/monitoring on the Internal Operations component to detect anomalous access. Avoid exposing the EBS application to the public internet where feasible. Do not rely on the 'Information Disclosure' tag to downscope urgency - the vector indicates integrity and availability impact as well.