CVE-2026-60942
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Vulnerability in Oracle Service Fulfillment Manager (Fulfillment Engine component) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and modify it.
Risk Assessment
Risk of unauthorized read and modification of critical data in Oracle Service Fulfillment Manager, potentially compromising confidentiality and integrity.
Recommendation
Apply the patch provided by Oracle in the Critical Patch Update (CPU) for E-Business Suite.
Other vulnerabilities in Oracle Service Fulfillment Manager
See all- CVE-2017-3285High
Vulnerability in the Oracle Service Fulfillment Manager component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise the system. It requires interaction from a third party, which may lead to unauthorized access to critical data.
- CVE-2017-3284High
Vulnerability in the Oracle Service Fulfillment Manager component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise the system. It requires interaction from a third party, increasing the risk for the organization.
- CVE-2026-70786High
Vulnerability in Oracle Service Fulfillment Manager (component: Fulfillment Engine) versions 12.2.3-12.2.15. A low-privileged attacker can gain unauthorized access to critical data and modify it. Requires user interaction, CVSS 7.6.
- CVE-2026-60943High
Vulnerability in Oracle Service Fulfillment Manager (Fulfillment Engine component) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can take over the system, but exploitation is difficult.
- CVE-2026-60941High
Vulnerability in Oracle Service Fulfillment Manager (component: Fulfillment Engine) versions 12.2.3-12.2.15. Allows a high-privileged attacker with network access via HTTP to perform unauthorized creation, deletion, or modification of critical data and gain full access to all data.
Original NVD description (English source)
Vulnerability in the Oracle Service Fulfillment Manager product of Oracle E-Business Suite (component: Fulfillment Engine). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Fulfillment Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Service Fulfillment Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Service Fulfillment Manager accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).