CVE-2026-60802 in E-Business Intelligence
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle E-Business Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle E-Business Intelligence. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle E-Business Intelligence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle E-Business Intelligence accessible data as well as unauthorized read access to a subset of Oracle E-Business Intelligence accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
This vulnerability resides within Oracle E-Business Intelligence component of the Oracle E-Business Suite, specifically within the Internal Operations module. The affected versions span from 12.2.3 through 12.2.15, representing a significant portion of the product lifecycle that organizations have deployed across their enterprise environments. The vulnerability represents a critical security weakness that stems from insufficient authentication mechanisms within the HTTP interface, allowing an unauthenticated attacker to potentially compromise the entire Oracle E-Business Intelligence system without requiring any prior credentials or privileged access.
The technical flaw manifests as a lack of proper authorization controls within the internal operations framework, creating an attack vector that operates over standard HTTP protocols. This vulnerability is classified as easily exploitable due to its accessibility through network-based attacks without requiring special privileges or complex attack chains. The CVSS 3.1 score of 6.1 reflects the moderate severity impact with confidentiality and integrity implications, while the attack vector analysis shows AV:N (Network) AC:L (Low) PR:N (None) UI:R (Required) S:C (Scope Change). This scoring indicates that while the attacker does not need to be authenticated initially, successful exploitation requires some level of user interaction from an unwitting individual within the target environment.
The operational impact of this vulnerability extends beyond the immediate Oracle E-Business Intelligence system and can affect additional products through what is termed "scope change" in the CVSS vector. This means that a successful attack on the E-Business Intelligence component could potentially allow attackers to compromise other interconnected systems or applications that share common infrastructure or data access patterns. The vulnerability enables unauthorized modification of data through update, insert, or delete operations against specific Oracle E-Business Intelligence accessible data sets, while also allowing unauthorized read access to subsets of sensitive information. This dual capability creates significant risk for organizations relying on the integrity and confidentiality of their business intelligence data.
Organizations should prioritize immediate remediation efforts by applying the relevant Oracle security patches or updates that address this vulnerability. The implementation of network-based controls such as firewalls, intrusion detection systems, and web application firewalls can provide additional layers of protection while permanent fixes are being deployed. Security monitoring should be enhanced to detect anomalous access patterns or unauthorized data modifications within the E-Business Intelligence environment. Additionally, organizations should conduct comprehensive risk assessments to understand how this vulnerability might affect their broader IT ecosystem, particularly focusing on any systems that may share common authentication mechanisms or data repositories with Oracle E-Business Intelligence. The vulnerability aligns with CWE-287 (Improper Authentication) and represents a significant concern for organizations operating under the ATT&CK framework's initial access and credential access tactics, potentially enabling lateral movement and persistent access within targeted environments.
This vulnerability type represents a common class of security flaws in enterprise business intelligence systems where authentication controls are insufficiently enforced at critical interface points. The requirement for human interaction suggests that social engineering or phishing attacks may be leveraged to facilitate exploitation, making user awareness training an essential component of the overall security strategy. Organizations should also review their access control policies and implement principle of least privilege concepts to minimize potential damage from successful exploitation attempts. The scope change aspect indicates that this vulnerability could serve as a stepping stone for more extensive attacks against related systems within the enterprise infrastructure, emphasizing the need for comprehensive security postures rather than isolated system protections.