CVE-2026-60572 in E-Business Suite Integrated SOA Gateway
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: Web Service Provider). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle E-Business Suite Integrated SOA Gateway accessible data as well as unauthorized read access to a subset of Oracle E-Business Suite Integrated SOA Gateway accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within the Oracle E-Business Suite Integrated SOA Gateway component known as Web Service Provider, representing a significant security weakness that affects versions 12.2.3 through 12.2.15. The flaw manifests as an easily exploitable vulnerability that can be leveraged by low-privileged attackers who possess network access via HTTP protocols. The vulnerability's accessibility and the relatively low privilege requirements for exploitation make it particularly concerning for organizations relying on this enterprise suite. The security risk is further amplified by the fact that the attack vector requires minimal sophistication, potentially allowing unauthorized users to gain substantial access rights within the system's boundaries.
The technical nature of this vulnerability enables attackers to achieve multiple forms of unauthorized access within the Integrated SOA Gateway environment. Specifically, successful exploitation grants adversaries the ability to perform unauthorized updates, inserts, or deletions on certain data accessible through the gateway. Additionally, attackers can obtain unauthorized read access to a subset of data that should remain protected, creating potential exposure of sensitive business information. The vulnerability also permits attackers to cause partial denial of service conditions, which can disrupt system availability and impact business operations. This multi-faceted attack capability demonstrates how a single vulnerability can compromise confidentiality, integrity, and availability aspects of the system's security posture.
The CVSS 3.1 base score of 6.3 reflects the moderate severity of this vulnerability, with impact scores of 6.3 for confidentiality, integrity, and availability. The vector representation CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L indicates that the attack requires network access with low complexity, only low privilege requirements, no user interaction needed, and affects the entire system without requiring a specific security scope. This scoring aligns with CWE-284 (Improper Access Control) as the underlying weakness, which is categorized under the broader class of access control vulnerabilities in the Common Weakness Enumeration database. The vulnerability's classification also maps to ATT&CK technique T1078 (Valid Accounts) and T1566 (Phishing) as potential initial access vectors that attackers might use to establish footholds before exploiting this specific weakness.
Organizations should implement immediate mitigations including applying the latest Oracle security patches and updates, which typically address such access control weaknesses through proper authentication and authorization mechanisms. Network segmentation and firewall rules should be enforced to limit direct HTTP access to the SOA Gateway components, while monitoring solutions should be deployed to detect unusual access patterns or attempted exploitation activities. Regular vulnerability assessments and penetration testing are essential to identify similar weaknesses across the enterprise infrastructure that may present comparable risks. Access controls should be reviewed and strengthened to ensure proper principle of least privilege enforcement, particularly for web service endpoints within the E-Business Suite environment. The implementation of intrusion detection systems and security information event management solutions can help detect and respond to exploitation attempts targeting this specific vulnerability type.