CVE-2026-60807

HighCVSS 8.0

Published: 21/07/2026(UTC)Updated: 29/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

24th percentile - higher than 24% of all known CVEs

Summary

Vulnerability in Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). Affected versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can easily exploit this, but user interaction is required. Successful attack can result in takeover of Oracle Bills of Material. CVSS 8.0 (Confidentiality, Integrity, Availability).

Risk Assessment

A low-privileged attacker can take full control of the Bills of Material component, potentially leading to data theft, modification, or disruption.

Recommendation

Apply the security patch provided by Oracle for Oracle Bills of Material on versions 12.2.3-12.2.15.

Other vulnerabilities in Oracle Bills of Material

CVE-2026-70718High
Vulnerability in Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). Affects versions 12.2.3-12.2.15. Difficult to exploit, allows a low-privileged attacker via HTTP to take over Oracle Bills of Material, with potential impact on other products.

Original NVD description (English source)

Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Bills of Material. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).