CVE-2026-60802
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Vulnerability in Oracle E-Business Intelligence (Internal Operations) versions 12.2.3-12.2.15. An unauthenticated attacker via HTTP, requiring user interaction, can compromise data and affect other products.
Risk Assessment
Attack can lead to unauthorized read and modification of data in Oracle E-Business Intelligence and other systems, compromising confidentiality and integrity.
Recommendation
Apply Oracle patches for Oracle E-Business Intelligence. Restrict HTTP access for unauthenticated users.
Other vulnerabilities in Oracle E-Business Intelligence
See all- CVE-2026-60804Low
In Oracle E-Business Intelligence (versions 12.2.3-12.2.15), a vulnerability in the Definition component allows a high-privileged attacker with network access via HTTP to gain unauthorized update, insert, or delete access to some data, requiring user interaction.
- CVE-2026-60801Medium
Vulnerability in Oracle E-Business Intelligence (component: Internal Operations) allows a high-privileged attacker to gain unauthorized access and modify critical data. The attack is difficult, requires network access via HTTP.
- CVE-2026-60736High
Vulnerability in Oracle E-Business Intelligence product of Oracle E-Business Suite (component: Definition). Affects versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise data confidentiality and integrity.
Original NVD description (English source)
Vulnerability in the Oracle E-Business Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle E-Business Intelligence. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle E-Business Intelligence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle E-Business Intelligence accessible data as well as unauthorized read access to a subset of Oracle E-Business Intelligence accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).