CVE-2026-60670
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Vulnerability in Oracle Applications Technology Stack (part of Oracle E-Business Suite) allows an unauthenticated attacker over HTTP to compromise the system. Exploitation is difficult.
Risk Assessment
An attacker can fully compromise Oracle Applications Technology Stack, leading to complete loss of confidentiality, integrity, and availability.
Recommendation
Apply Oracle patches for versions 12.2.3-12.2.15. Harden HTTP server configuration and monitor logs.
Other vulnerabilities in Oracle Applications Technology Stack
See all- CVE-2015-4839High
Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to DB Listener.
- CVE-2015-4798High
An unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to DB Listener.
- CVE-2014-4278High
Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 12.0.6, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Oracle Forms.
- CVE-2026-60762Medium
Vulnerability in the Configuration component of Oracle Applications Technology Stack (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. Difficult to exploit, requires login and high privileges. Attacker can unauthorized create, delete or modify critical data and gain full access to it.
Original NVD description (English source)
Vulnerability in the Oracle Applications Technology Stack product of Oracle E-Business Suite (component: Client System Analyzer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Technology Stack. Successful attacks of this vulnerability can result in takeover of Oracle Applications Technology Stack. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).