CVE-2026-60785

Undergoing Analysis Undergoing Analysis - In Progress

Authentication Bypass in Oracle iReceivables

Publication date: 2026-07-21

Last updated on: 2026-07-29

Assigner: Oracle

Description

Vulnerability in the Oracle iReceivables product of Oracle E-Business Suite (component: AR Web Utilities). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iReceivables. Successful attacks of this vulnerability can result in takeover of Oracle iReceivables. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-29

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60785

EUVD

EUVD-2026-47102

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	ireceivables	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle iReceivables, part of Oracle E-Business Suite. It affects versions 12.2.3 to 12.2.15. An unauthenticated attacker can exploit it remotely via HTTP to take over the system. The vulnerability has a CVSS score of 8.1, indicating high impact on confidentiality, integrity, and availability.

Detection Guidance

Detection requires checking for Oracle iReceivables versions 12.2.3 to 12.2.15. Inspect Oracle E-Business Suite installations for these versions. Verify if HTTP access to Oracle iReceivables is exposed without authentication. Check server logs for unusual access patterns or requests targeting the AR Web Utilities component.

Impact Analysis

If you use Oracle iReceivables in versions 12.2.3 to 12.2.15, an attacker could exploit this to take over the system. This could lead to unauthorized access, data theft, or disruption of services. The high CVSS score suggests significant risk.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR or HIPAA requirements for data protection and confidentiality. Compliance could be impacted if sensitive data is exposed or altered.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update (CPU) for Oracle E-Business Suite to address the vulnerability in Oracle iReceivables. Ensure the AR Web Utilities component is updated to a non-vulnerable version (12.2.3 or later patched). Restrict network access to HTTP ports used by Oracle iReceivables via firewalls or network segmentation.

Hi! I’m here to help you understand CVE-2026-60785. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70