Internal Operations Vulnerability in Oracle E-Business Suite
CVE-2026-60880

9.8CRITICAL

Key Information:

Vendor

Oracle
Status
Oracle Work In Process
Vendor
CVE Published:
21 July 2026

What is CVE-2026-60880?

A vulnerability exists in the Internal Operations component of Oracle E-Business Suite affecting the Work in Process functionality. This security flaw allows an unauthenticated attacker to gain network access via HTTP, potentially leading to total compromise of the Oracle Work in Process system. Versions 12.2.3 through 12.2.15 are impacted. Exploiting this vulnerability can allow unauthorized modifications and access to sensitive information, severely undermining both the confidentiality and integrity of the affected systems.

Affected Version(s)

Oracle Work in Process 12.2.3 <= 12.2.15

References

https://www.oracle.com/security-alerts/cpujul2026.html
vendor-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.