CVE-2026-60789
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Offline. Successful attacks of this vulnerability can result in takeover of Oracle Sales Offline. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Sales Offline, a component of the Oracle E-Business Suite that enables offline operations for sales personnel. The affected versions span from 12.2.3 through 12.2.15, representing a significant portion of the product lifecycle. The vulnerability manifests as an easily exploitable flaw that requires minimal prerequisites for successful exploitation, making it particularly dangerous in production environments where security controls may be insufficient.
The technical nature of this vulnerability stems from insufficient input validation and access control mechanisms within the Internal Operations component of Oracle Sales Offline. An attacker with low privileges and network access via HTTP can leverage this weakness to gain complete control over the affected system. The CVSS 3.1 score of 8.8 indicates high severity across all impact vectors, demonstrating that successful exploitation can result in full compromise of confidentiality, integrity, and availability. The attack vector AV:N indicates network-based exploitation without requiring physical access or special privileges beyond basic network connectivity.
The operational impact of this vulnerability extends far beyond simple data theft or system modification. A successful compromise of Oracle Sales Offline could enable attackers to manipulate sales transactions, alter customer records, disrupt business processes, and potentially gain access to sensitive financial information within the broader Oracle E-Business Suite environment. Given that this is an offline component, attackers might also be able to establish persistence mechanisms that survive system restarts or network outages, creating long-term security risks for organizations relying on this functionality.
Organizations should prioritize immediate remediation through Oracle's official patch releases addressing this vulnerability, as the low privilege requirement and network accessibility make it particularly attractive to threat actors. Additionally, implementing network segmentation controls, monitoring for unusual HTTP traffic patterns, and conducting regular vulnerability assessments can help detect and prevent exploitation attempts. The vulnerability aligns with CWE-20 (Improper Input Validation) and may map to ATT&CK techniques involving credential access and privilege escalation. Regular security assessments should include verification of patch compliance and testing of access controls to ensure the integrity of offline sales operations within Oracle E-Business Suite environments.