CVE-2026-60896 in Work in Process
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Work in Process executes to compromise Oracle Work in Process. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Work in Process accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Work in Process. CVSS 3.1 Base Score 3.6 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Work in Process, a critical component of the Oracle E-Business Suite that manages manufacturing and production operations. The flaw exists in the Internal Operations module and affects all supported versions from 12.2.3 through 12.2.15, representing a significant attack surface for organizations utilizing this enterprise resource planning solution. The vulnerability's classification as difficult to exploit indicates that while it requires specific conditions and privileges to be leveraged effectively, the potential impact remains substantial given Oracle's widespread adoption in enterprise environments.
The technical nature of this vulnerability stems from insufficient access controls within the Internal Operations component, allowing a low-privileged attacker who has already established logon credentials to the underlying infrastructure where Oracle Work in Process operates. This represents a privilege escalation scenario where the attacker can bypass normal access restrictions and gain unauthorized read access to sensitive data within the application's scope. The vulnerability's CVSS 3.1 score of 3.6 reflects moderate severity, with confidentiality and availability impacts rated as low to medium, though the combination of these factors creates a meaningful risk for organizations relying on production data integrity.
The operational impact of this vulnerability manifests in two primary areas: unauthorized data access and partial denial of service conditions. Attackers can potentially read sensitive manufacturing data, work orders, production schedules, and other operational information that would normally be restricted to authorized personnel. Additionally, the ability to cause partial denial of service means that legitimate users may experience disruptions in their ability to access critical manufacturing processes, potentially leading to production delays and operational inefficiencies. This dual nature of impact makes the vulnerability particularly concerning for manufacturing environments where data integrity and system availability are paramount.
Organizations should implement multiple layers of defense to mitigate this vulnerability effectively, beginning with immediate patching of affected Oracle E-Business Suite versions to the latest supported releases. Network segmentation and access control measures should be strengthened to limit the attack surface, ensuring that only authorized personnel have access to systems running Oracle Work in Process. The principle of least privilege must be strictly enforced, with regular audits of user accounts and permissions to prevent unauthorized access to critical infrastructure components. Additionally, monitoring solutions should be deployed to detect anomalous access patterns that might indicate exploitation attempts, as this vulnerability requires a foothold within the target infrastructure to be effectively leveraged.
This vulnerability aligns with CWE-284 (Improper Access Control) and represents a classic case of insufficient authorization checks within enterprise applications. From an ATT&CK framework perspective, it maps to techniques involving privilege escalation and credential access, particularly the use of valid accounts for unauthorized access. The low privilege requirement for exploitation and the need for infrastructure access aligns with ATT&CK's initial access phase, while the data read and denial of service capabilities correspond to the collection and impact phases respectively. Organizations should also consider implementing database activity monitoring solutions that can detect unauthorized queries against sensitive manufacturing tables, providing additional visibility into potential exploitation attempts. The vulnerability demonstrates the critical importance of maintaining up-to-date security patches and implementing comprehensive security monitoring across all components of enterprise applications, particularly those handling sensitive operational data in manufacturing environments.