CVE-2026-60760 in Enterprise Asset Management
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Asset Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Asset Management accessible data as well as unauthorized read access to a subset of Oracle Enterprise Asset Management accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Enterprise Asset Management, a critical component of the Oracle E-Business Suite ecosystem that manages enterprise asset lifecycle processes including maintenance, repair, and operations. The flaw exists in the Internal Operations component and affects all versions from 12.2.3 through 12.2.15, representing a significant attack surface for organizations utilizing this enterprise resource planning solution. The vulnerability classification as difficult to exploit indicates that while the attack vector requires some technical skill and knowledge, it remains within the realm of practical threat exploitation given the widespread deployment of affected versions across enterprise environments.
The technical nature of this vulnerability stems from insufficient access controls and authentication mechanisms within the HTTP interface of Oracle Enterprise Asset Management. Attackers with low privilege levels can leverage network access through standard HTTP protocols to manipulate system data integrity and confidentiality. This represents a classic privilege escalation scenario where minimal user credentials can be leveraged to achieve unauthorized data operations. The CVSS 3.1 scoring of 4.2 reflects the moderate severity impact, with both confidentiality and integrity affected at level low, indicating that while the vulnerability doesn't allow for complete system compromise or availability disruption, it provides attackers with meaningful access to sensitive operational data.
The operational impact of this vulnerability extends beyond simple data theft, as attackers can perform unauthorized update, insert, and delete operations against specific portions of the asset management database. This capability enables malicious actors to corrupt maintenance schedules, alter asset configurations, or manipulate financial records associated with enterprise assets. The unauthorized read access to subsets of accessible data creates additional risks where attackers can gather intelligence about organizational asset inventories, maintenance procedures, and operational workflows that could inform more sophisticated attacks. Organizations using Oracle E-Business Suite in regulated environments face particular risk as this vulnerability could compromise compliance requirements related to audit trails and data integrity.
From a cybersecurity framework perspective, this vulnerability aligns with CWE-284 (Improper Access Control) and maps to ATT&CK techniques including T1078 (Valid Accounts) for privilege escalation and T1566 (Phishing) for initial access. The network-based attack vector suggests this vulnerability could be exploited through common web application attacks such as SQL injection or cross-site scripting if proper input validation is absent. Organizations should prioritize immediate patching of affected versions, implement network segmentation to limit HTTP access to critical systems, and conduct comprehensive vulnerability assessments of their Oracle E-Business Suite deployments. Additionally, monitoring for unauthorized database access patterns and implementing robust network intrusion detection systems can help identify exploitation attempts before significant damage occurs. The vulnerability demonstrates the importance of maintaining up-to-date security patches in enterprise environments where legacy systems remain operational, as these platforms often contain critical business functions that make them attractive targets for cyber adversaries seeking to exploit known weaknesses in older software versions.