CVE-2026-60775
Summary
by MITRE • 07/22/2026
Vulnerability in the Pasta product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Pasta executes to compromise Pasta. Successful attacks of this vulnerability can result in takeover of Pasta. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability identified in Oracle E-Business Suite Pasta component represents a critical security weakness within the internal operations framework that affects versions 12.2.3 through 12.2.15. This flaw resides in the Pasta product's architecture and specifically targets the internal operations functionality, making it particularly concerning for organizations relying on this enterprise suite for business-critical processes.
The technical nature of this vulnerability stems from insufficient privilege controls and access restrictions within the Pasta component execution environment. The flaw allows a high-privileged attacker who has already established legitimate logon credentials to the underlying infrastructure where Pasta operates to gain complete control over the Pasta service itself. This represents a significant escalation of privileges scenario where the initial access level is leveraged to compromise the core operational component.
The operational impact of this vulnerability extends beyond simple privilege escalation as it can result in full takeover of the Pasta system, potentially disrupting critical business processes and data operations. The CVSS 3.1 score of 6.7 indicates a medium-high severity threat with high impacts across confidentiality, integrity, and availability domains. This means that successful exploitation could lead to unauthorized data access, modification of critical business information, and complete service disruption affecting enterprise operations.
The attack vector requires local access to the infrastructure where Pasta executes, making it moderately accessible to attackers who have already breached system boundaries through other means. The low attack complexity and high privilege requirements indicate that this vulnerability is not easily exploitable by casual threat actors but represents a serious risk for sophisticated attackers with insider access or those who have achieved initial system compromise.
Organizations should implement immediate mitigation strategies including network segmentation to limit local access to Pasta execution environments, enhanced monitoring of system activities around Pasta operations, and regular security assessments of the E-Business Suite components. The vulnerability aligns with CWE-276 which addresses incorrect permissions for critical resources, and maps to ATT&CK technique T1068 which covers local privilege escalation through system administration access.
Comprehensive remediation requires applying Oracle's official security patches and updates to affected versions, implementing strict access controls for system administrators, and conducting thorough vulnerability assessments of the entire E-Business Suite deployment. Regular security audits should verify that Pasta components are properly isolated from unauthorized access paths while maintaining necessary operational functionality for legitimate business processes.