CVE-2026-60862
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Order Management. While the vulnerability is in Oracle Order Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Order Management accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Order Management, a critical component of the Oracle E-Business Suite ecosystem, specifically within the Product Diagnostic Tools module. The affected versions span from 12.2.3 through 12.2.15, indicating a substantial attack surface across multiple release iterations. The vulnerability's classification as easily exploitable suggests that attackers with high privileges and network access via HTTP can successfully compromise the system without requiring extraordinary circumstances or specialized knowledge.
The technical flaw manifests as a privilege escalation vulnerability that operates through HTTP network protocols, making it particularly dangerous in environments where web-based interfaces are commonly used for administrative tasks. The CVSS 3.1 base score of 6.8 reflects the significant confidentiality impact, with a vector indicating network accessibility (AV:N), low attack complexity (AC:L), high privileges required (PR:H), and a scope change that affects additional products beyond the primary target. This scope change aspect is particularly concerning as it suggests cascading effects that can compromise systems beyond the immediate Oracle Order Management environment.
The operational impact of this vulnerability extends far beyond simple data access, potentially enabling unauthorized access to critical business data or complete system compromise within the Oracle Order Management domain. The high confidentiality impact (C:H) indicates that successful exploitation could result in exposure of sensitive customer information, order details, pricing data, and other proprietary business intelligence. Organizations utilizing these specific Oracle E-Business Suite versions face significant risk of data breaches and operational disruption when this vulnerability remains unpatched.
Security practitioners should consider this vulnerability in relation to CWE-284, which addresses improper access control mechanisms, and align it with ATT&CK framework techniques such as T1078 for valid accounts and T1566 for social engineering. The scope change element suggests potential lateral movement capabilities within the enterprise environment, where initial compromise of Order Management could provide pathways to other Oracle applications or integrated systems. Organizations should prioritize immediate patch deployment through Oracle's security updates, implement network segmentation to limit HTTP access to administrative functions, and conduct comprehensive vulnerability assessments across their entire Oracle E-Business Suite ecosystem. Additionally, monitoring for unusual network activity related to HTTP requests targeting Order Management components should be established as part of defensive measures against potential exploitation attempts.