CVE-2026-60913 in Property Manager
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Property Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Property Manager executes to compromise Oracle Property Manager. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Property Manager accessible data. CVSS 3.1 Base Score 1.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Property Manager, a component of the Oracle E-Business Suite that manages property-related data and operations. The affected versions span from 12.2.3 through 12.2.15, indicating a prolonged period during which this security gap existed. The vulnerability is classified as difficult to exploit, requiring an attacker with high privileged access to the underlying infrastructure where Oracle Property Manager executes. This prerequisite significantly limits the attack surface but does not eliminate the risk entirely, particularly in environments where insider threats or compromised accounts exist.
The technical flaw manifests as a weakness that allows unauthorized read access to a subset of data within Oracle Property Manager. While the confidentiality impact is rated at 1.9 on the CVSS 3.1 scale, this assessment reflects the limited scope of data exposure rather than the severity of the underlying vulnerability itself. The CVSS vector analysis reveals that the attack requires local system access with high privileges, meaning an attacker must already have substantial control over the target environment. The unspecified scope change (S:U) indicates that the vulnerability does not affect the broader system beyond the targeted application's data access controls.
The operational impact of this vulnerability extends beyond simple data theft, as it represents a potential vector for information gathering and reconnaissance activities. An attacker with sufficient privileges could extract sensitive property management data, potentially including tenant information, lease details, or financial records that could be valuable for further exploitation or malicious activities. This aligns with CWE-284 access control weaknesses where insufficient privileges are granted to authenticated users, though the specific implementation flaw here appears to be within the internal operations component rather than general access controls.
Organizations should prioritize patching this vulnerability through Oracle's official security updates and advisories, as the affected versions represent a significant window of exposure. The recommendation includes implementing strict access controls and monitoring for unusual activities in environments where Oracle Property Manager operates, particularly around privilege escalation attempts or unauthorized data access patterns. This vulnerability also highlights the importance of principle of least privilege enforcement, ensuring that even privileged accounts have minimal necessary permissions to reduce potential damage from compromised credentials. The ATT&CK framework would categorize this under privilege escalation techniques where attackers leverage existing system access to gain additional capabilities within a specific application context.
Security teams must conduct comprehensive assessments of their Oracle E-Business Suite deployments to identify all instances running affected versions, particularly focusing on internal operations that may not receive the same level of monitoring as externally facing applications. The low severity rating does not diminish the need for immediate remediation, as the vulnerability could serve as a stepping stone for more significant attacks if combined with other exploitation vectors or if the environment contains additional weaknesses that could be leveraged to escalate privileges beyond the initial access level.