CVE-2026-60854: Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Quality. While the vulnerability is in Oracle Quality, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Quality accessible data as well as unauthorized update, insert or delete access to some of Oracle Quality accessible
CVE-2026-60854 is a high-severity vulnerability in Oracle Quality, a component of Oracle E-Business Suite. It affects versions 12.2.3 through 12.2.15. The flaw allows a high privileged attacker with network access via HTTP to compromise Oracle Quality, potentially impacting additional Oracle products. Successful exploitation can lead to unauthorized access to critical data, unauthorized modification (update, insert, delete) of some data, and partial denial of service conditions. The CVSS 3.1 base score is 8.2, reflecting high confidentiality impact, moderate integrity impact, and low availability impact. Oracle has published a Critical Patch Update advisory referencing this vulnerability but does not explicitly state patch availability or remediation status for Oracle Quality in the provided content.
AI Analysis
Technical Summary
This vulnerability exists in Oracle Quality versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite. It is exploitable by a high privileged attacker with network access via HTTP. The vulnerability allows unauthorized access to critical data and partial modification capabilities, as well as the ability to cause partial denial of service. The vulnerability has a CVSS 3.1 score of 8.2 with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L, indicating network attack vector, low attack complexity, high privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and low availability impact. The vendor advisory is a general Critical Patch Update notice listing many products but does not explicitly confirm patch availability or remediation details for Oracle Quality or this specific CVE. No known exploits in the wild have been reported.
Potential Impact
Successful exploitation can result in unauthorized access to all data accessible by Oracle Quality, unauthorized update, insert, or delete operations on some data, and partial denial of service conditions affecting Oracle Quality. The vulnerability also has scope change implications, potentially impacting additional Oracle products beyond Oracle Quality. The confidentiality impact is high, integrity impact is low, and availability impact is low according to the CVSS vector.
Mitigation Recommendations
The vendor advisory references a Critical Patch Update released in July 2026 covering multiple Oracle products, including Oracle Quality. However, the advisory does not explicitly confirm patch availability or provide specific remediation instructions for CVE-2026-60854. Customers should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply relevant patches promptly. Until confirmed patched, restrict network access to Oracle Quality interfaces to trusted users with high privileges and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2026-60854: Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Quality. While the vulnerability is in Oracle Quality, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Quality accessible data as well as unauthorized update, insert or delete access to some of Oracle Quality accessible
Description
CVE-2026-60854 is a high-severity vulnerability in Oracle Quality, a component of Oracle E-Business Suite. It affects versions 12.2.3 through 12.2.15. The flaw allows a high privileged attacker with network access via HTTP to compromise Oracle Quality, potentially impacting additional Oracle products. Successful exploitation can lead to unauthorized access to critical data, unauthorized modification (update, insert, delete) of some data, and partial denial of service conditions. The CVSS 3.1 base score is 8.2, reflecting high confidentiality impact, moderate integrity impact, and low availability impact. Oracle has published a Critical Patch Update advisory referencing this vulnerability but does not explicitly state patch availability or remediation status for Oracle Quality in the provided content.
CVSS v3.1
Score 8.2high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability exists in Oracle Quality versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite. It is exploitable by a high privileged attacker with network access via HTTP. The vulnerability allows unauthorized access to critical data and partial modification capabilities, as well as the ability to cause partial denial of service. The vulnerability has a CVSS 3.1 score of 8.2 with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L, indicating network attack vector, low attack complexity, high privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and low availability impact. The vendor advisory is a general Critical Patch Update notice listing many products but does not explicitly confirm patch availability or remediation details for Oracle Quality or this specific CVE. No known exploits in the wild have been reported.
Potential Impact
Successful exploitation can result in unauthorized access to all data accessible by Oracle Quality, unauthorized update, insert, or delete operations on some data, and partial denial of service conditions affecting Oracle Quality. The vulnerability also has scope change implications, potentially impacting additional Oracle products beyond Oracle Quality. The confidentiality impact is high, integrity impact is low, and availability impact is low according to the CVSS vector.
Mitigation Recommendations
The vendor advisory references a Critical Patch Update released in July 2026 covering multiple Oracle products, including Oracle Quality. However, the advisory does not explicitly confirm patch availability or provide specific remediation instructions for CVE-2026-60854. Customers should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply relevant patches promptly. Until confirmed patched, restrict network access to Oracle Quality interfaces to trusted users with high privileges and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-07-08T15:51:55.596Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cpujul2026.html","vendor":"Oracle"}]
Threat ID: 6a5fee169c2644c7f8d5c5a4
Added to database: 07/21/2026, 22:09:26 UTC
Last enriched: 07/22/2026, 03:22:25 UTC
Last updated: 07/22/2026, 03:22:25 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.