CVE-2026-60571
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle SDP Number Portability product of Oracle E-Business Suite (component: Installation). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SDP Number Portability. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle SDP Number Portability accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle SDP Number Portability. CVSS 3.1 Base Score 5.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle E-Business Suite's Oracle SDP Number Portability component, specifically during the installation phase of the software. The affected versions span from 12.2.3 through 12.2.15, representing a significant release range that would impact numerous enterprise deployments. The vulnerability is classified as easily exploitable, indicating that attackers with minimal technical expertise can leverage it effectively. The attack vector requires only network access via HTTP protocol, making it particularly dangerous as it can be initiated from external networks without requiring physical access to the target system.
The technical flaw manifests as a weakness in the authorization and authentication mechanisms within the installation process of the Oracle SDP Number Portability module. This allows a low privileged attacker to gain unauthorized access to modify or manipulate data within the affected component. The vulnerability's CVSS score of 5.4 reflects moderate severity with specific impacts to integrity and availability, as indicated by the vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. The low privilege requirement suggests that even users with minimal system access could exploit this weakness, while the network accessibility means attackers can target systems remotely without requiring direct system interaction.
The operational impact of this vulnerability extends beyond simple data manipulation to include partial denial of service conditions that can disrupt normal business operations. Successful exploitation enables unauthorized update, insert, or delete operations against sensitive data within the Oracle SDP Number Portability component, potentially compromising the integrity of number portability records that are critical for telecommunications services. Additionally, the partial denial of service capability means that attackers could degrade system performance or availability, affecting service continuity and customer satisfaction. This vulnerability directly aligns with CWE-284 (Improper Access Control) and represents a significant risk to enterprise data integrity within Oracle E-Business Suite deployments.
Organizations should implement immediate mitigations including network segmentation to limit access to the affected Oracle SDP Number Portability installation components, enhanced firewall rules restricting HTTP access to authorized administrative networks only, and comprehensive monitoring of HTTP traffic for suspicious activities. The vulnerability also demonstrates characteristics consistent with ATT&CK technique T1078 (Valid Accounts) as attackers could potentially leverage legitimate accounts to exploit this weakness. Regular patching and updates should be prioritized to address this vulnerability, while security teams should conduct thorough assessments of their Oracle E-Business Suite deployments to identify similar authorization weaknesses across other components that may present comparable risks to organizational security posture.