Description
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Search Bean). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in takeover of Oracle Applications Framework. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-21
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw exists in the Search Bean component of Oracle Applications Framework, allowing a low‑privileged attacker who can reach the system over HTTP to bypass authorization and obtain full control. This weakness results in confidentiality, integrity, and availability impacts, reflected by a CVSS v3.1 base score of 8.8.

Affected Systems

Oracle Applications Framework versions 12.2.3 through 12.2.15 in Oracle E‑Business Suite are affected. Any installation of these releases without the security update is vulnerable, and no specific build beyond that range is listed.

Risk and Exploitability

The EPSS score is below 1%, indicating a low current likelihood of exploitation, but the high CVSS score and absence of a KEV listing imply that if an attacker discovers the vulnerability it can be leveraged with simple network access to the HTTP interface. Attackers need only low‑privileged network access; no elevated credentials are required to take over the framework.

Generated by OpenCVE AI on August 5, 2026 at 01:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle patch that addresses the Search Bean authorization bypass on Oracle Applications Framework versions 12.2.3–12.2.15.
  • Limit HTTP access to the framework by implementing firewall or ACL rules that allow only trusted internal hosts or subnets.
  • Monitor web and application logs for abnormal Search Bean activity and configure alerts for potential exploitation attempts.

Generated by OpenCVE AI on August 5, 2026 at 01:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 02:15:00 +0000

Type Values Removed Values Added
Title Oracle Applications Framework Search Bean Authorization Bypass

Tue, 04 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
Title Authorization Bypass in Oracle Applications Framework Search Bean Leading to Compromise
Weaknesses CWE-284

Sat, 01 Aug 2026 05:45:00 +0000

Type Values Removed Values Added
Title Authorization Bypass in Oracle Applications Framework Search Bean Leading to Compromise
Weaknesses CWE-284

Thu, 30 Jul 2026 13:45:00 +0000

Type Values Removed Values Added
Title Low Privilege HTTP Exploit Compromising Oracle Applications Framework
Weaknesses CWE-284

Thu, 23 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
Title Low Privilege HTTP Exploit Compromising Oracle Applications Framework
Weaknesses CWE-284

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Search Bean). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in takeover of Oracle Applications Framework. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle applications Framework
CPEs cpe:2.3:a:oracle:applications_framework:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle applications Framework
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Applications Framework
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-24T19:19:21.896Z

Reserved: 2026-07-08T15:51:55.577Z

Link: CVE-2026-60676

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-07-21T22:18:08.573

Modified: 2026-07-31T21:23:36.097

Link: CVE-2026-60676

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T02:00:12Z

Weaknesses