CVE-2026-60670

Analyzed Analyzed - Analysis Complete

Oracle Applications Technology Stack Remote Code Execution

Publication date: 2026-07-21

Last updated on: 2026-08-07

Assigner: Oracle

Description

Vulnerability in the Oracle Applications Technology Stack product of Oracle E-Business Suite (component: Client System Analyzer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Technology Stack. Successful attacks of this vulnerability can result in takeover of Oracle Applications Technology Stack. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-07

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60670

EUVD

EUVD-2026-47029

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	applications_technology_stack	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Applications Technology Stack within Oracle E-Business Suite, specifically in the Client System Analyzer component. It affects versions 12.2.3 to 12.2.15 and allows an unauthenticated attacker with network access via HTTP to potentially take over the entire Oracle Applications Technology Stack.

Detection Guidance

Detection of CVE-2026-60670 requires checking for vulnerable versions of Oracle Applications Technology Stack (12.2.3-12.2.15) and monitoring HTTP traffic for exploitation attempts. Oracle recommends applying the latest patches and reviewing logs for suspicious activity. No specific commands are provided in the available context.

Impact Analysis

If exploited, this vulnerability could lead to a complete compromise of the Oracle Applications Technology Stack. This means an attacker could gain control over the system, potentially accessing, modifying, or deleting sensitive data, disrupting services, or using the compromised system for further attacks.

Compliance Impact

This vulnerability allows unauthenticated attackers to compromise the Oracle Applications Technology Stack, potentially leading to unauthorized access, data breaches, or system takeover. Such impacts could violate GDPR (data protection) and HIPAA (health data security) by exposing sensitive information or disrupting critical systems.

Mitigation Strategies

Apply the latest Oracle E-Business Suite patches for the Client System Analyzer component. Restrict network access to HTTP ports for Oracle Applications Technology Stack. Monitor for unusual activity in the Oracle Applications Technology Stack logs.

Hi! I’m here to help you understand CVE-2026-60670. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70