CVE-2026-60886: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Work in Process. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Work in Process, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Work in Process
CVE-2026-60886 is a high-severity vulnerability in Oracle Work in Process (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the product, requiring user interaction from someone other than the attacker. Successful exploitation can lead to unauthorized access to critical data and unauthorized modification of some data within Oracle Work in Process. The vulnerability also has a scope change, potentially impacting additional Oracle products. The CVSS 3.1 base score is 7.6, reflecting high confidentiality impact and partial integrity impact.
AI Analysis
Technical Summary
This vulnerability affects Oracle Work in Process versions 12.2.3 to 12.2.15 and involves an easily exploitable flaw that allows a low privileged attacker with network access via HTTP to compromise the product. Exploitation requires human interaction from a third party. The vulnerability can result in unauthorized access to critical data and unauthorized update, insert, or delete operations on some data. The vulnerability has a scope change, meaning it may impact additional Oracle products beyond Work in Process. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, required user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle has published a Critical Patch Update advisory for July 2026 but does not explicitly confirm patch availability or remediation status for this specific vulnerability in the provided content.
Potential Impact
Successful exploitation can lead to unauthorized access to critical data within Oracle Work in Process and unauthorized modification (update, insert, delete) of some accessible data. The vulnerability affects confidentiality and integrity, with no impact on availability. The scope change indicates potential impact on additional Oracle products beyond Oracle Work in Process. The attack requires user interaction from a person other than the attacker, and the attacker needs network access via HTTP with low privileges.
Mitigation Recommendations
Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities, including this one. However, the specific patch or remediation status for CVE-2026-60886 is not explicitly stated in the advisory content provided. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions. Applying the latest security patches promptly is recommended to mitigate this vulnerability. Since the vulnerability requires user interaction, user awareness and caution regarding unexpected interactions may help reduce risk until patches are applied.
CVE-2026-60886: Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Work in Process. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Work in Process, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Work in Process
Description
CVE-2026-60886 is a high-severity vulnerability in Oracle Work in Process (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the product, requiring user interaction from someone other than the attacker. Successful exploitation can lead to unauthorized access to critical data and unauthorized modification of some data within Oracle Work in Process. The vulnerability also has a scope change, potentially impacting additional Oracle products. The CVSS 3.1 base score is 7.6, reflecting high confidentiality impact and partial integrity impact.
CVSS v3.1
Score 7.6high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects Oracle Work in Process versions 12.2.3 to 12.2.15 and involves an easily exploitable flaw that allows a low privileged attacker with network access via HTTP to compromise the product. Exploitation requires human interaction from a third party. The vulnerability can result in unauthorized access to critical data and unauthorized update, insert, or delete operations on some data. The vulnerability has a scope change, meaning it may impact additional Oracle products beyond Work in Process. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, required user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle has published a Critical Patch Update advisory for July 2026 but does not explicitly confirm patch availability or remediation status for this specific vulnerability in the provided content.
Potential Impact
Successful exploitation can lead to unauthorized access to critical data within Oracle Work in Process and unauthorized modification (update, insert, delete) of some accessible data. The vulnerability affects confidentiality and integrity, with no impact on availability. The scope change indicates potential impact on additional Oracle products beyond Oracle Work in Process. The attack requires user interaction from a person other than the attacker, and the attacker needs network access via HTTP with low privileges.
Mitigation Recommendations
Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities, including this one. However, the specific patch or remediation status for CVE-2026-60886 is not explicitly stated in the advisory content provided. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions. Applying the latest security patches promptly is recommended to mitigate this vulnerability. Since the vulnerability requires user interaction, user awareness and caution regarding unexpected interactions may help reduce risk until patches are applied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-07-08T15:51:55.598Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cpujul2026.html","vendor":"Oracle"}]
Threat ID: 6a5fee179c2644c7f8d5c620
Added to database: 07/21/2026, 22:09:27 UTC
Last enriched: 07/22/2026, 03:07:55 UTC
Last updated: 07/22/2026, 03:07:55 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.