CVE-2026-60738

Received Received - Intake

Oracle Installed Base Takeover via HTTP in E-Business Suite

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Oracle

Description

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks of this vulnerability can result in takeover of Oracle Installed Base. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-60738

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	installed_base	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Installed Base within Oracle E-Business Suite. It allows a low-privileged attacker with network access to take over the system. The flaw exists in the Create Item Instance component and affects versions 12.2.3 to 12.2.15.

Detection Guidance

Detection requires checking for Oracle Installed Base versions 12.2.3 to 12.2.15. Review Oracle E-Business Suite logs for unusual HTTP access patterns or unauthorized item instance creation attempts.

Impact Analysis

An attacker could exploit this to gain full control over Oracle Installed Base, leading to potential data breaches, unauthorized modifications, or system disruptions. This could affect business operations and sensitive data integrity.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Apply Oracle's official patch for CVE-2026-60738 immediately. Restrict network access to Oracle Installed Base via HTTP. Monitor for suspicious activity and review user privileges to ensure least access.

Hi! I’m here to help you understand CVE-2026-60738. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70