CVE-2026-60762 in Applications Technology Stack
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Applications Technology Stack product of Oracle E-Business Suite (component: Configuration). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Applications Technology Stack executes to compromise Oracle Applications Technology Stack. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Applications Technology Stack accessible data as well as unauthorized access to critical data or complete access to all Oracle Applications Technology Stack accessible data. CVSS 3.1 Base Score 5.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within the Oracle Applications Technology Stack component of Oracle E-Business Suite, specifically affecting the configuration module. The affected versions span from 12.2.3 through 12.2.15, indicating a prolonged period of exposure across multiple releases. The vulnerability's classification as difficult to exploit suggests that while it requires specific conditions to be successfully leveraged, the potential impact remains severe given the privileged access requirements. The attack vector requires an attacker with existing logon credentials to the target infrastructure where Oracle Applications Technology Stack operates, establishing a baseline of pre-existing compromise that reduces the overall attack surface but increases the potential damage scope.
The technical flaw manifests as a privilege escalation vulnerability that allows an attacker with high privileges to perform unauthorized modifications to critical system data. The CVSS 3.1 base score of 5.7 reflects the significant impact on both confidentiality and integrity aspects of the security triad, with a vector indicating local access requirements (AV:L), high attack complexity (AC:H), high privilege requirements (PR:H), and no user interaction needed (UI:N). This configuration vulnerability represents a critical weakness in the access control mechanisms that govern data modification operations within the Oracle Applications Technology Stack environment.
The operational impact of successful exploitation encompasses unauthorized creation, deletion, or modification of critical data within the Oracle Applications Technology Stack accessible data repository. Attackers could potentially gain complete access to all system data and achieve unauthorized access to critical information assets that the application manages. This represents a severe compromise of data integrity and confidentiality, as malicious actors could alter configuration settings, modify business data, or delete critical system components that maintain the operational continuity of enterprise applications. The vulnerability essentially undermines the fundamental security controls designed to protect sensitive enterprise data within the Oracle E-Business Suite ecosystem.
Organizations should implement immediate mitigations including comprehensive access control reviews, mandatory privilege auditing, and enhanced monitoring of configuration changes within the Oracle Applications Technology Stack environment. System administrators should conduct thorough vulnerability assessments to identify and remediate this issue across all affected versions, while implementing principle of least privilege controls to minimize potential impact from compromised accounts. The vulnerability aligns with CWE-276, which addresses improper privileges in system components, and represents a significant concern under ATT&CK framework category T1078 for valid accounts and T1566 for credential access techniques that could lead to such internal compromise scenarios.