CVE-2026-60923
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Vulnerability in Oracle Capacity (Internal Operations component) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data, and attacks may impact additional products (scope change).
Risk Assessment
Risk of critical data leakage from Oracle Capacity and potential impact on other systems in E-Business Suite.
Recommendation
Apply the patch provided by Oracle in the Critical Patch Update (CPU) for E-Business Suite.
Other vulnerabilities in Oracle Capacity
See all- CVE-2026-101543High
Vulnerability in the Oracle Capacity product (component: Internal Operations) of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. A difficult to exploit flaw allows a low privileged attacker with network access via HTTP to compromise Oracle Capacity.
- CVE-2026-101542High
Vulnerability in the Oracle Capacity product (component: Internal Operations) of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low privileged attacker with network access via HTTP to compromise Oracle Capacity.
- CVE-2026-101541High
Vulnerability in the Oracle Capacity product (component: Internal Operations) of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data or complete access to all Oracle Capacity accessible data, with potential impact on additional products.
- CVE-2026-101540High
Vulnerability in the Oracle Capacity product (component: Internal Operations) of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data or complete access to all Oracle Capacity accessible data, with potential impact on additional products.
- CVE-2026-101398High
Vulnerability in Oracle Capacity (Oracle E-Business Suite), Internal Operations component, affecting versions 12.2.3-12.2.15. Easily exploitable by a low-privileged attacker with HTTP network access, allowing unauthorized access to critical data, modification of some data, and partial denial of service (partial DOS).
- CVE-2026-101387High
Vulnerability in Oracle Capacity (Oracle E-Business Suite), Internal Operations component, affecting versions 12.2.3-12.2.15. Easily exploitable by a low-privileged attacker with HTTP network access, allowing unauthorized access to critical data, modification of some data, and partial denial of service (partial DOS).
Original NVD description (English source)
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity. While the vulnerability is in Oracle Capacity, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Capacity accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

