CVE-2026-60310

Received Received - Intake

Oracle Performance Management Data Access Flaw

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Oracle

Description

Vulnerability in the Oracle Performance Management product of Oracle E-Business Suite (component: Appraisals). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Performance Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Performance Management accessible data as well as unauthorized read access to a subset of Oracle Performance Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-60310

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	performance_management	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Performance Management within Oracle E-Business Suite. It affects versions 12.2.3 to 12.2.15 and allows low-privileged attackers with network access to read or modify some data in the Performance Management component. The CVSS score is 5.4, indicating moderate impact on confidentiality and integrity.

Detection Guidance

Detection requires checking for Oracle Performance Management versions 12.2.3 to 12.2.15. Inspect Oracle E-Business Suite components for exposed HTTP interfaces. Verify if low-privileged users can access appraisals data without authentication.

Impact Analysis

If exploited, this vulnerability could let attackers access or alter sensitive performance data stored in Oracle Performance Management. This may lead to unauthorized changes in employee evaluations or data leaks, depending on the exposed information.

Compliance Impact

This vulnerability could compromise data confidentiality and integrity, potentially violating GDPR or HIPAA if personal or health-related data is exposed or altered. Organizations must assess if their use of Oracle Performance Management involves regulated data.

Mitigation Strategies

Apply Oracle's latest patches for Oracle Performance Management. Restrict network access to HTTP interfaces via firewalls. Implement strict access controls to limit low-privileged user permissions. Monitor logs for unauthorized data access attempts.

Hi! I’m here to help you understand CVE-2026-60310. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70