CVE-2026-60854
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Vulnerability in Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). Affected versions 12.2.3-12.2.15. A high-privileged attacker with network access via HTTP can easily exploit this, leading to unauthorized access to critical data, full access to all Oracle Quality data, unauthorized update/insert/delete of some data, and partial denial of service. Attacks may impact additional products (scope change). CVSS 8.2 (Confidentiality, Integrity, Availability).
Risk Assessment
A high-privileged attacker can gain full access to quality data, modify it, or cause partial system unavailability, potentially disrupting quality control processes.
Recommendation
Apply the security patch provided by Oracle for Oracle Quality on versions 12.2.3-12.2.15.
Other vulnerabilities in Oracle Quality
See all- CVE-2026-62525Medium
A vulnerability in Oracle Quality (Oracle E-Business Suite) versions 12.2.3-12.2.15 allows a low-privileged attacker with network access via HTTP to gain unauthorized read, update, insert, or delete access to some data and cause a partial denial of service.
- CVE-2026-60855High
Vulnerability in Oracle Quality (component: Internal Operations) versions 12.2.3-12.2.15. Difficult to exploit, but a low-privileged attacker with network access via HTTP can take over Oracle Quality.
- CVE-2026-46952High
Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations) affects versions 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Quality.
- CVE-2026-46951High
Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations) allows a low privileged attacker with network access via HTTP to compromise Oracle Quality. This vulnerability can be easily exploited in versions 12.2.3-12.2.15.
Original NVD description (English source)
Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Quality. While the vulnerability is in Oracle Quality, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Quality accessible data as well as unauthorized update, insert or delete access to some of Oracle Quality accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Quality. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L).