CVE-2026-60891
LowCVSS 1.9Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In Oracle Work in Process (part of Oracle E-Business Suite) versions 12.2.3-12.2.15, a vulnerability in the Internal Operations component. Difficult to exploit, allows a high-privileged attacker with local access to unauthorized read access to a subset of data. CVSS 1.9.
Risk Assessment
The organization is at risk of unauthorized data read in Oracle Work in Process by a high-privileged attacker, potentially leading to information disclosure.
Recommendation
Apply the Oracle patch for Oracle E-Business Suite versions 12.2.3-12.2.15.
Original NVD description (English source)
Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Work in Process executes to compromise Oracle Work in Process. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Work in Process accessible data. CVSS 3.1 Base Score 1.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N).