CVE-2026-60886 in Work in Process
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Work in Process. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Work in Process, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Work in Process accessible data as well as unauthorized update, insert or delete access to some of Oracle Work in Process accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Work in Process, a critical component of the Oracle E-Business Suite that manages manufacturing operations and work order processing. The affected versions span from 12.2.3 through 12.2.15, representing a significant portion of the Oracle EBS product lineage where this security flaw has persisted. The vulnerability's classification as easily exploitable indicates that attackers can leverage relatively simple attack vectors without requiring advanced technical skills or extensive resources to execute successful compromises.
The technical nature of this flaw manifests through an insufficient authorization mechanism within the Internal Operations component, allowing low privileged users with network access via HTTP protocols to gain unauthorized system access. This represents a classic privilege escalation vulnerability where minimal user credentials can be leveraged to achieve elevated access levels. The CVSS 3.1 base score of 7.6 reflects the severity of impact, particularly concerning confidentiality and integrity aspects. The attack vector AV:N indicates network-based exploitation without requiring physical access, while AC:L demonstrates low complexity requirements for successful execution. The PR:L classification shows that only low privileges are needed to initiate the attack, and UI:R reveals that human interaction from an unwitting user is required for full exploitation.
The operational impact of this vulnerability extends beyond the immediate Oracle Work in Process component, creating a scope change that can affect additional Oracle EBS products within the ecosystem. This interconnected nature means that exploitation of this single vulnerability can potentially compromise entire manufacturing and operational workflows managed by the E-Business Suite. Successful attacks can result in unauthorized access to critical manufacturing data including work orders, production schedules, inventory tracking information, and other sensitive operational details. The confidentiality impact is rated as high (C:H) indicating potential exposure of sensitive business operations and proprietary manufacturing processes.
The integrity implications are equally concerning with an impact rating of L (low) for the insert, update, or delete operations. However, this rating should not be dismissed lightly as unauthorized modifications to work order data, production schedules, or inventory records can cause significant operational disruption and financial loss. The vulnerability's potential for data manipulation means attackers could alter critical manufacturing parameters, modify production timelines, or corrupt operational databases leading to supply chain disruptions. This aligns with CWE-284 (Improper Access Control) and represents a fundamental breakdown in the security model of the Oracle EBS platform.
Mitigation strategies should prioritize immediate patch deployment through Oracle's official security updates and patches addressing this specific vulnerability. Network segmentation and access controls should be implemented to limit exposure points, while monitoring systems should be enhanced to detect unusual access patterns in manufacturing databases. The principle of least privilege must be strictly enforced across all Oracle EBS components, ensuring that users only receive necessary permissions for their operational roles. Organizations should also implement comprehensive audit trails and logging mechanisms to track access to sensitive manufacturing data. Regular security assessments and vulnerability scanning should be conducted to identify similar authorization gaps within the broader Oracle EBS environment.
The attack surface is further complicated by the requirement for human interaction, which suggests social engineering or phishing campaigns targeting legitimate users who may inadvertently trigger the vulnerability through malicious web requests. This aspect of exploitation aligns with ATT&CK techniques involving credential access and privilege escalation. Organizations should implement user awareness training programs to prevent accidental exploitation while maintaining robust network monitoring capabilities to detect anomalous behavior patterns that might indicate exploitation attempts.
Security teams should also consider implementing database activity monitoring solutions specifically designed for Oracle environments, as these tools can provide granular visibility into data access and modification activities within the Work in Process component. The interconnected nature of this vulnerability means that organizations must approach security holistically, considering not just individual components but the entire Oracle EBS ecosystem where this flaw could enable cascading effects across multiple business applications and operational processes.