CVE-2026-60760
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Vulnerability in Oracle Enterprise Asset Management (Oracle E-Business Suite) versions 12.2.3-12.2.15. Difficult to exploit, requires low privileges and network access via HTTP. Successful attack may lead to unauthorized update, insert, delete, or read access to some data. CVSS 4.2 (Confidentiality and Integrity impacts).
Risk Assessment
The organization may lose control over data integrity and confidentiality in the asset management module.
Recommendation
Apply the Oracle patch for Oracle Enterprise Asset Management and restrict network access to the system.
Other vulnerabilities in Oracle Enterprise Asset Management
See all- CVE-2026-61296High
Vulnerability in Oracle Enterprise Asset Management (component: Linear Asset Management) affects versions 12.2.3-12.2.15. A low-privileged attacker can, via HTTP and with user interaction, gain unauthorized access to critical data and modify some data, with potential impact on other products.
- CVE-2026-60695Medium
Vulnerability in Oracle Enterprise Asset Management (component: Internal Operations) allows a high-privileged attacker to gain unauthorized access and modify critical data. The attack is difficult, requires network access via HTTP.
- CVE-2026-60694Medium
Vulnerability in Oracle Enterprise Asset Management (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP, with user interaction, can gain unauthorized read and modify access to some data, and the attack may impact other products.
- CVE-2026-60692High
Vulnerability in Oracle Enterprise Asset Management (Internal Operations component) versions 12.2.3-12.2.15. Low-privileged attacker via HTTP can take over the system.
- CVE-2026-60588Medium
Vulnerability in Oracle Enterprise Asset Management (component: Work Definition Issues) versions 12.2.3-12.2.15. A low-privileged attacker via HTTPS can gain unauthorized read and modify access to data.
- CVE-2026-46931High
A vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite allows low privileged attackers with network access via HTTP to compromise the system. Versions 12.2.6-12.2.15 are affected by this easily exploitable vulnerability.
Original NVD description (English source)
Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Asset Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Asset Management accessible data as well as unauthorized read access to a subset of Oracle Enterprise Asset Management accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).