CVE-2026-60844
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Customer Support product of Oracle E-Business Suite (component: Update Service Request). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Customer Support. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Customer Support accessible data as well as unauthorized access to critical data or complete access to all Oracle Customer Support accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle E-Business Suite's Customer Support product, specifically in the Update Service Request component where the flaw manifests as a security weakness allowing unauthorized access to critical business data. The affected versions span from 12.2.3 through 12.2.15, indicating a prolonged period of exposure that could have enabled extensive exploitation by threat actors. The vulnerability's classification as easily exploitable means that attackers with minimal privileges and network connectivity via HTTP can successfully compromise the system, representing a significant security risk for organizations relying on this enterprise resource planning solution.
The technical nature of this vulnerability stems from inadequate access controls within the Update Service Request functionality, allowing low privileged users to manipulate critical data through HTTP requests. This weakness directly violates fundamental security principles of least privilege and defense in depth, as it permits unauthorized modification, deletion, and creation operations against sensitive customer support data. The CVSS 3.1 score of 8.1 reflects the severity of impact with high confidentiality and integrity implications, indicating that successful exploitation could result in complete compromise of all accessible data within the Oracle Customer Support system.
From an operational perspective, this vulnerability represents a critical threat to enterprise data security and business continuity. Organizations utilizing affected versions of Oracle E-Business Suite face potential exposure of sensitive customer information, service request details, and other confidential business data that could be modified or deleted by unauthorized parties. The impact extends beyond simple data corruption to potentially disrupt business operations and compromise regulatory compliance requirements, particularly in industries subject to strict data protection regulations such as healthcare, financial services, or government sectors.
The attack vector through HTTP access demonstrates that this vulnerability can be exploited remotely without requiring physical system access or elevated privileges, making it particularly dangerous for organizations with internet-facing systems. This characteristic aligns with ATT&CK technique T1190 for exploiting vulnerabilities and follows CWE-284 (Improper Access Control) patterns, where insufficient authorization checks allow unauthorized data manipulation. Organizations should prioritize immediate patching of affected versions to prevent exploitation, while implementing network segmentation and monitoring controls to detect potential malicious activity targeting this specific component.
Mitigation strategies should include immediate deployment of Oracle's security patches addressing the identified vulnerability, followed by comprehensive access control reviews to ensure proper privilege levels are maintained. Network-level protections such as web application firewalls and intrusion detection systems should be configured to monitor for suspicious HTTP traffic patterns associated with service request updates. Additionally, organizations should conduct thorough vulnerability assessments to identify similar access control weaknesses in other components of their Oracle E-Business Suite installations, implementing principle of least privilege across all system interfaces and maintaining regular security updates to prevent future exploitation attempts.