CVE-2026-60978

Received Received - Intake

Oracle Scripting Data Access Vulnerability in Oracle E-Business Suite

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Oracle

Description

Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Scripting accessible data as well as unauthorized access to critical data or complete access to all Oracle Scripting accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-60978

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	scripting	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Scripting within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It allows a highly privileged attacker with network access to exploit HTTP interfaces, potentially leading to unauthorized data modification or access.

Impact Analysis

An attacker could create, delete, or modify critical data or gain full access to all data accessible through Oracle Scripting. This could lead to data breaches, loss of sensitive information, or system integrity issues.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating compliance requirements for GDPR (data protection) and HIPAA (health information security). Organizations may face legal penalties or reputational damage.

Mitigation Strategies

Apply the latest Oracle E-Business Suite patches for Oracle Scripting versions 12.2.3 to 12.2.15. Restrict network access to HTTP interfaces and enforce strict authentication for privileged users. Monitor logs for suspicious activity related to Oracle Scripting components.

Hi! I’m here to help you understand CVE-2026-60978. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70