CVE-2026-60891 in Work in Process
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Work in Process executes to compromise Oracle Work in Process. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Work in Process accessible data. CVSS 3.1 Base Score 1.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Work in Process, a critical component of Oracle E-Business Suite that manages manufacturing operations and work order processing. The flaw exists in the Internal Operations functionality and affects Oracle E-Business Suite versions 12.2.3 through 12.2.15, representing a significant attack surface for organizations utilizing these legacy systems. The vulnerability's classification as difficult to exploit indicates that while the attack vector requires specific conditions, the potential impact on data confidentiality remains concerning for enterprise environments where manufacturing data integrity is paramount.
The technical nature of this vulnerability stems from insufficient access controls within the Oracle Work in Process module, allowing a high-privileged attacker who already possesses legitimate system access to perform unauthorized read operations against specific data subsets. This weakness operates at the system level where the attacker must have established logon credentials to the infrastructure hosting Oracle Work in Process, but once authenticated, can leverage this flaw to access sensitive manufacturing and operational data. The CVSS 3.1 score of 1.9 reflects the limited impact scope with confidentiality as the primary concern while maintaining low integrity and availability impacts.
The operational implications of this vulnerability extend beyond simple data exposure, particularly within manufacturing environments where Oracle Work in Process typically contains sensitive production schedules, resource allocations, work order details, and operational metrics that could provide competitive intelligence to unauthorized parties. Organizations running these older E-Business Suite versions face particular risk as they may not have access to newer security patches or updates that would address this specific vulnerability. The attack requires an attacker with local system privileges, which aligns with ATT&CK technique T1078 for valid accounts and T1566 for social engineering or credential compromise methods.
Security practitioners should prioritize immediate assessment of affected systems within their environment to identify installations running Oracle E-Business Suite versions 12.2.3 through 12.2.15, particularly focusing on access control configurations and monitoring for unauthorized data access patterns. Organizations should implement network segmentation to limit local system access to Oracle Work in Process environments while ensuring proper privilege management and regular security assessments. The vulnerability's low exploitability factor suggests that organizations with proper security controls and privileged access management may already be protected, but the potential for insider threats or compromised accounts remains a significant concern.
Recommended mitigations include applying Oracle's security patches and updates as soon as possible, implementing additional monitoring for unauthorized data access attempts, reviewing and strengthening local system access controls, and conducting regular security assessments of manufacturing and operational data environments. The vulnerability aligns with CWE-284 Access Control Issues, specifically related to inadequate access restrictions on internal operations components. Organizations should also consider the broader context of their E-Business Suite deployment and evaluate whether migration to supported versions would provide more comprehensive security coverage against similar vulnerabilities. The low CVSS score does not diminish the importance of addressing this vulnerability, particularly in environments where manufacturing data represents sensitive business intelligence requiring protection against unauthorized disclosure.