CVE-2026-60852 in Lease and Finance Management
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Lease and Finance Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Lease and Finance Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Lease and Finance Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Lease and Finance Management, a critical component of the Oracle E-Business Suite that handles financial operations and lease management processes. The flaw exists in the Internal Operations component and affects all supported versions from 12.2.3 through 12.2.15, representing a significant attack surface across multiple release cycles. The vulnerability's classification as easily exploitable indicates that attackers can leverage relatively straightforward techniques to gain access, making it particularly dangerous for organizations relying on this financial management system.
The technical nature of this flaw allows a low-privileged attacker with network access via HTTP to compromise the entire Oracle Lease and Finance Management environment. This represents a severe privilege escalation issue where minimal authentication credentials can lead to substantial system compromise. The vulnerability's CVSS 3.1 base score of 8.1 places it in the high severity category, reflecting both the confidentiality and integrity impacts that can be achieved through exploitation. The attack vector AV:N indicates network-based access is sufficient, while AC:L shows low attack complexity, making this vulnerability particularly attractive to threat actors who may already have basic network connectivity to target systems.
The operational impact of successful exploitation is devastating for organizations using Oracle Lease and Finance Management, as attackers can achieve unauthorized creation, deletion, or modification access to critical financial data. This encompasses not just individual records but all accessible data within the system, potentially leading to complete financial record manipulation that could affect audit trails, compliance reporting, and business operations. The unauthorized access to critical data represents a direct threat to financial integrity and regulatory compliance, particularly in industries subject to strict financial auditing requirements such as banking, insurance, and public sector organizations.
Organizations should prioritize immediate patching of affected versions to mitigate this vulnerability, as the combination of low privilege requirements and high impact makes it extremely dangerous. The weakness aligns with CWE-284 (Improper Access Control) and potentially CWE-352 (Cross-Site Request Forgery) depending on implementation details, while mapping to ATT&CK techniques involving privilege escalation and data manipulation. Security teams should implement network segmentation to limit access to Oracle Lease and Finance Management systems, enforce strict authentication controls, and monitor for unusual database activities that might indicate exploitation attempts. Additionally, organizations should conduct thorough vulnerability assessments of their E-Business Suite deployments to identify any other potentially affected components that may present similar access control weaknesses.