CVE-2026-60788 in Sales Offline
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Offline. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Sales Offline accessible data as well as unauthorized access to critical data or complete access to all Oracle Sales Offline accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Sales Offline. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Sales Offline component of the Oracle E-Business Suite ecosystem, specifically affecting versions 12.2.3 through 12.2.15. The flaw represents a critical security weakness that stems from inadequate access controls and authentication mechanisms within the internal operations framework. The vulnerability manifests as an easily exploitable condition that requires minimal privileges and network connectivity through HTTP protocols to achieve successful compromise. This presents a significant risk to organizations relying on Oracle E-Business Suite for their sales operations management, as the affected component handles sensitive customer data, transactional information, and business-critical sales processes.
The technical nature of this vulnerability falls under CWE-284 Access Control Issues, specifically involving insufficient access control mechanisms that allow unauthorized users to perform administrative functions. Attackers with low privileged network access can leverage this weakness to execute unauthorized modifications to critical data repositories within Oracle Sales Offline. The vulnerability enables attackers to create, delete, or modify sensitive information, potentially compromising the integrity of sales records, customer data, and business transaction histories. Additionally, the flaw allows for complete unauthorized access to all data accessible through the Oracle Sales Offline component, effectively providing attackers with comprehensive read access to the entire dataset.
From an operational impact perspective, this vulnerability creates substantial risk of data compromise and service disruption within enterprise environments. Successful exploitation can result in unauthorized modification or deletion of critical sales data, potentially leading to financial losses, regulatory compliance violations, and damage to customer relationships. The partial denial of service aspect means that attackers can disrupt normal operations by corrupting data structures or overwhelming system resources through malicious requests. Organizations may experience cascading effects where compromised sales data impacts downstream business processes including inventory management, financial reporting, and customer relationship management systems that depend on accurate sales information.
The CVSS 3.1 score of 8.3 reflects the severity of this vulnerability across multiple impact vectors including confidentiality, integrity, and availability. The network accessibility (AV:N) combined with low privilege requirements (PR:L) creates an attack surface that can be exploited by remote adversaries without requiring physical access or elevated credentials. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L indicates that this vulnerability affects the entire system scope, meaning a successful attack impacts all accessible data within Oracle Sales Offline rather than being limited to specific user contexts. Organizations should prioritize immediate mitigation through Oracle's security patches and updates while implementing network segmentation controls to limit access to the affected components. Additional defensive measures include enhanced monitoring of HTTP traffic for suspicious patterns, implementation of web application firewalls, and regular vulnerability assessments to identify similar weaknesses in related Oracle E-Business Suite components that may be susceptible to similar attack vectors.