CVE-2026-60864
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Vulnerability in Oracle Order Management (Product Diagnostic Tools) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise confidentiality and integrity, affecting additional products.
Risk Assessment
Attack can lead to unauthorized read and modification of data in Oracle Order Management and other systems, threatening data confidentiality and integrity.
Recommendation
Apply the latest Oracle security patches for Oracle Order Management. Restrict network access to diagnostic tools.
Other vulnerabilities in Oracle Order Management
See all- CVE-2026-70932High
Vulnerability in Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Affects versions 12.2.3-12.2.15. A high-privileged attacker with local access can gain unauthorized access to critical data and modify or delete it, and attacks may impact additional products.
- CVE-2026-70930High
Vulnerability in Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Affects versions 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management. Successful attacks can result in takeover of Oracle Order Management.
- CVE-2026-70760High
Vulnerability in Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Affects versions 12.2.3-12.2.15. Difficult to exploit by low-privileged attacker via HTTP, with potential impact on other products (scope change). Allows unauthorized access to critical data and unauthorized update/insert/delete of some data.
- CVE-2026-61115High
Vulnerability in Oracle Order Management (Oracle E-Business Suite) allows a high-privileged attacker with network access via HTTP to take over the system. Affects versions 12.2.3-12.2.15.
- CVE-2026-60862Medium
Vulnerability in Oracle Order Management (Oracle E-Business Suite) versions 12.2.3-12.2.15. An authenticated attacker with high privileges can access critical data via HTTP, with potential impact on other products (scope change).
Original NVD description (English source)
Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management. While the vulnerability is in Oracle Order Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Order Management accessible data as well as unauthorized read access to a subset of Oracle Order Management accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).