CVE-2026-60888 in Work in Process
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Work in Process. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Work in Process accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Work in Process, a critical component of Oracle E-Business Suite that manages manufacturing and production processes. The flaw exists in the Internal Operations functionality and affects versions 12.2.3 through 12.2.15, representing a significant attack surface for malicious actors targeting enterprise resource planning systems. The vulnerability classification as difficult to exploit indicates that while the attack vector requires some technical expertise, the potential impact makes it a serious concern for organizations utilizing these specific Oracle versions.
The technical nature of this vulnerability allows a low-privileged attacker with network access via HTTP to compromise the Oracle Work in Process system. This represents a privilege escalation scenario where minimal initial access can potentially lead to extensive data breaches. The CVSS 3.1 base score of 5.3 reflects the confidentiality impact, indicating that successful exploitation could result in unauthorized access to critical data or complete access to all Oracle Work in Process accessible data. The attack vector AV:N indicates network-based exploitation without requiring physical access, while AC:H suggests that the attack requires some level of sophistication to execute successfully.
From an operational standpoint, this vulnerability poses significant risks to manufacturing and production data integrity, potentially exposing sensitive information about work orders, material requirements, capacity planning, and other critical business processes. Organizations running affected Oracle E-Business Suite versions face potential exposure to intellectual property theft, supply chain disruption, and operational data compromise that could impact production schedules and business continuity. The vulnerability's classification under CWE 284 (Improper Access Control) aligns with its nature as a privilege escalation issue that allows unauthorized access to protected resources.
The threat landscape for this vulnerability demonstrates how attackers might leverage it through web-based attacks targeting the Oracle Work in Process interface, potentially using techniques such as SQL injection or session manipulation to gain unauthorized access. Organizations should consider implementing network segmentation to limit access to Oracle applications and deploy web application firewalls to monitor and filter HTTP traffic to these systems. The ATT&CK framework would classify this vulnerability under T1071.004 (Application Layer Protocol: DNS) and potentially T1566 (Phishing) if attackers use social engineering to gain initial access before exploiting this weakness.
Mitigation strategies should include immediate patching of affected Oracle E-Business Suite versions, implementation of network monitoring solutions to detect anomalous HTTP traffic patterns, and enforcement of strict access controls through Oracle's built-in security mechanisms. Organizations should also consider conducting comprehensive vulnerability assessments to identify other potential attack vectors within their Oracle environments and establish incident response procedures specifically tailored to address Oracle application vulnerabilities. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) emphasizes that while the attack requires some technical sophistication, the impact on confidentiality is severe, making proactive security measures essential for protecting critical manufacturing data assets.