CVE-2026-60844

Analyzed Analyzed - Analysis Complete

Oracle Customer Support Data Access Vulnerability

Publication date: 2026-07-21

Last updated on: 2026-08-06

Assigner: Oracle

Description

Vulnerability in the Oracle Customer Support product of Oracle E-Business Suite (component: Update Service Request). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Customer Support. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Customer Support accessible data as well as unauthorized access to critical data or complete access to all Oracle Customer Support accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-06

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-10

NVD

CVE-2026-60844

EUVD

EUVD-2026-47143

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	customer_support	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Customer Support within Oracle E-Business Suite. It affects versions 12.2.3 to 12.2.15. An attacker with low privileges and network access via HTTP can exploit it to compromise the system.

Detection Guidance

Detection of this vulnerability requires monitoring Oracle Customer Support components for unauthorized access or modifications. Check Oracle E-Business Suite logs for unusual HTTP requests targeting the Update Service Request component. Review user permissions and recent changes to critical data within the Oracle Customer Support module.

Impact Analysis

An attacker could create, delete, or modify critical data or gain unauthorized access to all Oracle Customer Support accessible data. This includes unauthorized access to sensitive information.

Compliance Impact

This vulnerability allows unauthorized access to critical data or complete access to all Oracle Customer Support accessible data, which could lead to unauthorized creation, deletion, or modification of sensitive information. This poses significant risks to compliance with GDPR and HIPAA, as it may result in data breaches, unauthorized disclosures, or loss of data integrity.

Mitigation Strategies

Apply the latest Oracle E-Business Suite patches for versions 12.2.3-12.2.15 to address the Oracle Customer Support vulnerability. Restrict network access to HTTP ports used by Oracle Customer Support and limit privileges for users accessing the system.

Hi! I’m here to help you understand CVE-2026-60844. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70