CVE-2026-60685

Analyzed Analyzed - Analysis Complete

Oracle iSupport Cross-Site Scripting (XSS) Vulnerability

Publication date: 2026-07-21

Last updated on: 2026-08-07

Assigner: Oracle

Description

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iSupport, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle iSupport accessible data as well as unauthorized read access to a subset of Oracle iSupport accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-07

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60685

EUVD

EUVD-2026-47040

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	e-business_suite	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle iSupport, part of Oracle E-Business Suite. It affects versions 12.2.3 to 12.2.15. An unauthenticated attacker can exploit it remotely via HTTP to compromise the system. Exploitation requires human interaction from a victim and may impact other products. The attack can lead to unauthorized data access or modification.

Detection Guidance

Detection involves checking for Oracle iSupport instances and verifying their patch levels. Inspect network traffic for HTTP requests to Oracle iSupport endpoints. Review system logs for unusual access patterns or unauthorized data modifications. Ensure Oracle E-Business Suite versions 12.2.3 to 12.2.15 are updated to the latest patches.

Impact Analysis

An attacker could read or modify some data accessible through Oracle iSupport. This includes unauthorized updates, inserts, or deletes to data, as well as unauthorized data access. The impact depends on the data exposed via iSupport and could affect business operations or sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, which may violate GDPR (data protection) or HIPAA (health data privacy). Compliance risks include data breaches, loss of confidentiality, and failure to meet regulatory requirements for data integrity and access controls.

Mitigation Strategies

Apply the latest Oracle E-Business Suite patches for Oracle iSupport versions 12.2.3 to 12.2.15. Restrict network access to HTTP ports used by Oracle iSupport. Monitor for unusual data access or modifications in Oracle iSupport.

Hi! I’m here to help you understand CVE-2026-60685. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70