CVE-2026-60322

Analyzed Analyzed - Analysis Complete

Oracle Applications Manager Unauthorized Data Access Vulnerability

Publication date: 2026-07-21

Last updated on: 2026-08-03

Assigner: Oracle

Description

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Manager accessible data as well as unauthorized read access to a subset of Oracle Applications Manager accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-03

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60322

EUVD

EUVD-2026-46737

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	applications_manager	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Applications Manager within Oracle E-Business Suite. It allows an unauthenticated attacker with network access via HTTP to potentially compromise the system. Successful exploitation could lead to unauthorized data access or modification, specifically affecting some data in Oracle Applications Manager.

Detection Guidance

Detection of CVE-2026-60322 requires checking for vulnerable versions of Oracle Applications Manager (12.2.3-12.2.15) and monitoring for unauthorized HTTP access attempts. Inspect Oracle E-Business Suite logs for unusual network activity or data access patterns. Use network scanning tools to identify Oracle Applications Manager instances and verify their patch levels.

Impact Analysis

If exploited, this vulnerability could allow attackers to read or modify certain data in Oracle Applications Manager without authentication. This may lead to data breaches, unauthorized changes, or other security incidents depending on the system's configuration and data stored.

Compliance Impact

This vulnerability could impact compliance with regulations like GDPR or HIPAA by enabling unauthorized access to sensitive data. Organizations using affected Oracle E-Business Suite versions may face compliance violations, legal risks, or penalties if data is compromised due to this flaw.

Mitigation Strategies

Apply the latest Oracle E-Business Suite patches for versions 12.2.3-12.2.15 to address the vulnerability in Oracle Applications Manager. Restrict network access to HTTP ports used by Oracle Applications Manager to trusted sources only.

Hi! I’m here to help you understand CVE-2026-60322. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70