CVE-2026-60854 in Quality
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Quality. While the vulnerability is in Oracle Quality, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Quality accessible data as well as unauthorized update, insert or delete access to some of Oracle Quality accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Quality. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle Quality component of the Oracle E-Business Suite, specifically within the Internal Operations module, affecting versions 12.2.3 through 12.2.15. The flaw represents a significant security weakness that can be exploited by attackers with high privileges and network access via HTTP protocols. The vulnerability's classification as easily exploitable indicates that the attack vector requires minimal technical sophistication while still maintaining the potential for severe consequences.
The technical nature of this vulnerability stems from insufficient authorization controls within the Oracle Quality module, allowing a privileged attacker to bypass normal security restrictions. The CVSS 3.1 score of 8.2 reflects the high severity impact across confidentiality, integrity, and availability domains. Attackers with network access and elevated privileges can potentially gain unauthorized access to critical data within the Oracle Quality system, including complete access to all accessible data. Additionally, successful exploitation enables unauthorized modification capabilities, allowing attackers to insert, update, or delete data within the affected module.
The scope of this vulnerability extends beyond the immediate Oracle Quality component, creating a potential scope change impact that can affect additional Oracle products within the E-Business Suite ecosystem. This cascading effect demonstrates how vulnerabilities in one component can compromise the broader enterprise application environment. The partial denial of service aspect means attackers can disrupt system operations without completely disabling the service, creating operational challenges for business continuity.
The vulnerability's characteristics align with CWE-284 (Improper Access Control) and follow ATT&CK techniques related to privilege escalation and data access. The high privilege requirement suggests this is not a casual attack vector but rather targets individuals with legitimate access who may have been compromised or misused their privileges. Organizations should implement layered security controls including network segmentation, privileged access monitoring, and regular security assessments to mitigate the risk of exploitation.
Mitigation strategies should include immediate patching of affected Oracle E-Business Suite versions, implementation of network-based access controls to limit HTTP access to authorized systems only, and enhanced monitoring of administrative activities within Oracle Quality. Regular vulnerability assessments and security audits should be conducted to identify potential unauthorized access attempts. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L) indicates that while the attack requires network access with high privileges, the impact across confidentiality and availability makes this a critical concern for enterprise security teams.