Vulnerability in Oracle E-Business Suite's Upload Attachments Component
CVE-2026-60684

4.6MEDIUM

Key Information:

Vendor

Oracle
Status
Oracle Applications Framework
Vendor
CVE Published:
21 July 2026

What is CVE-2026-60684?

A vulnerability exists in the Upload Attachments component of the Oracle E-Business Suite which allows a low-privileged attacker to exploit the system via HTTP. This exploitation can lead to unauthorized modification, deletion, or reading of certain accessible data within the Oracle Applications Framework. Notably, successful exploitation requires interaction from a user other than the attacker, heightening the potential for unauthorized access to sensitive information.

Affected Version(s)

Oracle Applications Framework 12.2.8 <= 12.2.15

References

https://www.oracle.com/security-alerts/cpujul2026.html
vendor-advisory

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.