CVE-2026-60962
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Vulnerability in Oracle Flow Manufacturing (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP, with user interaction, can gain unauthorized read and modify access to some data, and the attack may impact other products.
Risk Assessment
An attacker can read or modify production data, potentially leading to disruptions in the manufacturing process and financial loss.
Recommendation
Apply the Oracle patch. Restrict access to Oracle Flow Manufacturing to trusted users and educate staff on security.
Other vulnerabilities in Oracle Flow Manufacturing
See all- CVE-2026-70801High
Vulnerability in Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Affects versions 12.2.3-12.2.15. Easily exploitable by low privileged attacker with network access via HTTP, allowing unauthorized access to critical data or complete access to all Oracle Flow Manufacturing accessible data, as well as unauthorized update, insert or delete access to some data.
- CVE-2026-62450High
Vulnerability in Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Affects versions 12.2.3-12.2.15. Easily exploitable by low-privileged attacker with network access via HTTP, can lead to takeover of Oracle Flow Manufacturing.
- CVE-2026-46837High
Vulnerability in Oracle Flow Manufacturing (component: Security) versions 12.2.9-12.2.15. A low-privileged attacker with network access via SQL can take over the system.
Original NVD description (English source)
Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Flow Manufacturing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Flow Manufacturing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Flow Manufacturing accessible data as well as unauthorized read access to a subset of Oracle Flow Manufacturing accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).