CVE-2026-60694
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Vulnerability in Oracle Enterprise Asset Management (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP, with user interaction, can gain unauthorized read and modify access to some data, and the attack may impact other products.
Risk Assessment
An attacker can read or modify asset management data, potentially leading to confidentiality and integrity breaches and financial loss.
Recommendation
Apply the Oracle patch. Restrict access to Oracle Enterprise Asset Management to trusted users and educate staff on security.
Other vulnerabilities in Oracle Enterprise Asset Management
See all- CVE-2026-61296High
Vulnerability in Oracle Enterprise Asset Management (component: Linear Asset Management) affects versions 12.2.3-12.2.15. A low-privileged attacker can, via HTTP and with user interaction, gain unauthorized access to critical data and modify some data, with potential impact on other products.
- CVE-2026-60760Medium
Vulnerability in Oracle Enterprise Asset Management (Oracle E-Business Suite) versions 12.2.3-12.2.15. Difficult to exploit, requires low privileges and network access via HTTP. Successful attack may lead to unauthorized update, insert, delete, or read access to some data. CVSS 4.2 (Confidentiality and Integrity impacts).
- CVE-2026-60695Medium
Vulnerability in Oracle Enterprise Asset Management (component: Internal Operations) allows a high-privileged attacker to gain unauthorized access and modify critical data. The attack is difficult, requires network access via HTTP.
- CVE-2026-60692High
Vulnerability in Oracle Enterprise Asset Management (Internal Operations component) versions 12.2.3-12.2.15. Low-privileged attacker via HTTP can take over the system.
- CVE-2026-60588Medium
Vulnerability in Oracle Enterprise Asset Management (component: Work Definition Issues) versions 12.2.3-12.2.15. A low-privileged attacker via HTTPS can gain unauthorized read and modify access to data.
- CVE-2026-46931High
A vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite allows low privileged attackers with network access via HTTP to compromise the system. Versions 12.2.6-12.2.15 are affected by this easily exploitable vulnerability.
Original NVD description (English source)
Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Asset Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Asset Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Asset Management accessible data as well as unauthorized read access to a subset of Oracle Enterprise Asset Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).