Vulnerability in Oracle E-Business Suite's Work in Process Component
CVE-2026-60891

1.9LOW

Key Information:

Vendor

Oracle
Status
Oracle Work In Process
Vendor
CVE Published:
21 July 2026

What is CVE-2026-60891?

A vulnerability has been identified in the Oracle Work in Process component of Oracle E-Business Suite that could be exploited by a highly privileged attacker. The issue allows an authenticated attacker with logon access to the affected system to gain unauthorized read access to limited Oracle Work in Process data. While its exploitability is considered challenging, the potential retrieval of sensitive data poses a noteworthy concern for users operating within the impacted versions ranging from 12.2.3 to 12.2.15.

Affected Version(s)

Oracle Work in Process 12.2.3 <= 12.2.15

References

https://www.oracle.com/security-alerts/cpujul2026.html
vendor-advisory

CVSS V3.1

Score:
1.9
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.