CVE-2026-60911
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Vulnerability in Oracle Property Manager (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP, with user interaction, can gain unauthorized read and modify access to some data, and the attack may impact other products.
Risk Assessment
An attacker can read or modify property data, potentially leading to confidentiality and integrity breaches and financial loss.
Recommendation
Apply the Oracle patch. Restrict access to Oracle Property Manager to trusted users and educate staff on security.
Other vulnerabilities in Oracle Property Manager
See all- CVE-2026-60913Low
Vulnerability in Oracle Property Manager (versions 12.2.3-12.2.15) allows a high-privileged attacker with local logon to read a subset of data.
- CVE-2026-60912Medium
Vulnerability in the Internal Operations component of Oracle Property Manager (Oracle E-Business Suite). A low-privileged attacker via HTTP can gain unauthorized data access (updates, inserts, deletions, read).
- CVE-2026-60910High
Vulnerability in Oracle Property Manager (Internal Operations component) versions 12.2.3-12.2.15. A high-privileged attacker with network access via HTTP can take over the system.
- CVE-2026-46956High
Vulnerability in the Oracle Property Manager product of Oracle E-Business Suite, affecting the Internal Operations component. Versions 12.2.3-12.2.15 are susceptible to easily exploitable attacks that can lead to the takeover of Oracle Property Manager by a high-privileged attacker with network access via HTTP.
Original NVD description (English source)
Vulnerability in the Oracle Property Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Property Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Property Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Property Manager accessible data as well as unauthorized read access to a subset of Oracle Property Manager accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).