CVE-2026-60963 in Treasury
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Treasury product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Treasury. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Treasury accessible data as well as unauthorized access to critical data or complete access to all Oracle Treasury accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Treasury, a component of the Oracle E-Business Suite that manages financial transactions and treasury operations. The affected versions span from 12.2.3 through 12.2.15, indicating a significant attack surface across multiple releases of the enterprise suite. The vulnerability is classified as easily exploitable, meaning that an attacker with minimal technical expertise can successfully leverage this flaw to compromise the system. This represents a critical security gap in Oracle's treasury management functionality.
The technical flaw manifests as a weakness in the Internal Operations component of Oracle Treasury that allows unauthorized access through HTTP network connections. This architectural vulnerability enables low-privileged attackers to bypass normal authentication and authorization controls, essentially granting them elevated privileges within the treasury application. The attack vector specifically utilizes HTTP protocols, making it accessible through standard web-based exploitation techniques and potentially amplifying the impact through automated scanning tools.
The operational impact of this vulnerability is severe and multifaceted, affecting both data integrity and confidentiality aspects of Oracle Treasury operations. Successful exploitation can enable attackers to create, delete, or modify critical financial data within the treasury system, potentially leading to financial fraud, data corruption, or complete loss of treasury information. The vulnerability also permits unauthorized access to all data accessible through Oracle Treasury, which typically includes sensitive financial records, transaction histories, and operational data that could be valuable for financial crimes or corporate espionage.
This vulnerability maps directly to CWE-287 (Improper Authentication) and CWE-250 (Execute Code from Untrusted Source) within the Common Weakness Enumeration framework. The CVSS 3.1 score of 8.1 reflects the high severity of the issue, with both confidentiality and integrity impacts rated as high. The attack vector is network-based (AV:N), meaning no physical access is required, while the low access complexity (AC:L) indicates that exploitation requires minimal technical skills. The low privilege requirement (PR:L) means that even users with basic accounts can exploit this vulnerability, and the lack of user interaction (UI:N) suggests that attacks can occur automatically without victim participation.
From an ATT&CK framework perspective, this vulnerability aligns with T1190 (Exploit Public-Facing Application) and T1078 (Valid Accounts) techniques, as attackers can leverage public web interfaces to gain unauthorized access. The compromise of Oracle Treasury specifically relates to T1546 (Event Triggered Execution) and T1566 (Phishing) as attackers might use this vulnerability to establish persistent access or move laterally within the enterprise network.
Organizations should immediately apply Oracle's security patches and updates to address this vulnerability, as the affected versions span multiple release cycles. Network segmentation should be implemented to limit access to Oracle Treasury systems, and monitoring should be enhanced to detect unusual HTTP traffic patterns. Access controls should be reviewed and strengthened, particularly for applications handling financial data. Regular vulnerability assessments and penetration testing are recommended to identify similar weaknesses in other Oracle E-Business Suite components. The implementation of principle of least privilege should be enforced across all treasury system access points to minimize potential impact if future vulnerabilities are discovered. Additionally, organizations should consider implementing web application firewalls and intrusion detection systems specifically configured to monitor for exploitation attempts targeting Oracle Treasury applications.