CVE-2026-60695
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Vulnerability in Oracle Enterprise Asset Management (component: Internal Operations) allows a high-privileged attacker to gain unauthorized access and modify critical data. The attack is difficult, requires network access via HTTP.
Risk Assessment
An attacker can compromise asset management data, leading to confidentiality and integrity breaches.
Recommendation
Apply the Oracle security patch for versions 12.2.3-12.2.15 or upgrade to a newer version.
Other vulnerabilities in Oracle Enterprise Asset Management
See all- CVE-2026-61296High
Vulnerability in Oracle Enterprise Asset Management (component: Linear Asset Management) affects versions 12.2.3-12.2.15. A low-privileged attacker can, via HTTP and with user interaction, gain unauthorized access to critical data and modify some data, with potential impact on other products.
- CVE-2026-60760Medium
Vulnerability in Oracle Enterprise Asset Management (Oracle E-Business Suite) versions 12.2.3-12.2.15. Difficult to exploit, requires low privileges and network access via HTTP. Successful attack may lead to unauthorized update, insert, delete, or read access to some data. CVSS 4.2 (Confidentiality and Integrity impacts).
- CVE-2026-60694Medium
Vulnerability in Oracle Enterprise Asset Management (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP, with user interaction, can gain unauthorized read and modify access to some data, and the attack may impact other products.
- CVE-2026-60692High
Vulnerability in Oracle Enterprise Asset Management (Internal Operations component) versions 12.2.3-12.2.15. Low-privileged attacker via HTTP can take over the system.
- CVE-2026-60588Medium
Vulnerability in Oracle Enterprise Asset Management (component: Work Definition Issues) versions 12.2.3-12.2.15. A low-privileged attacker via HTTPS can gain unauthorized read and modify access to data.
- CVE-2026-46931High
A vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite allows low privileged attackers with network access via HTTP to compromise the system. Versions 12.2.6-12.2.15 are affected by this easily exploitable vulnerability.
Original NVD description (English source)
Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Enterprise Asset Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Enterprise Asset Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Enterprise Asset Management accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N).