Description
Vulnerability in the Oracle Applications Technology Stack product of Oracle E-Business Suite (component: Configuration). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Applications Technology Stack executes to compromise Oracle Applications Technology Stack. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Applications Technology Stack accessible data as well as unauthorized access to critical data or complete access to all Oracle Applications Technology Stack accessible data. CVSS 3.1 Base Score 5.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-07-21
Score: 5.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An exploited flaw in the Configuration component of Oracle Applications Technology Stack allows a local, high-privileged attacker who can log in to the underlying infrastructure to create, delete, or modify critical data, or obtain complete access to all data managed by the stack. This results in both confidentiality and integrity loss for the data that the attacker can read or alter.

Affected Systems

Oracle Applications Technology Stack, part of Oracle E‑Business Suite, versions 12.2.3 through 12.2.15.

Risk and Exploitability

The CVSS score of 5.7 indicates moderate severity, and the EPSS score of less than 1 % shows a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV, and the exploit requires local administrative access, meaning only users who can log on to the host environment can potentially exploit it.

Generated by OpenCVE AI on August 4, 2026 at 02:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official Oracle patch released in the July 2026 Security Alert for all affected versions of Oracle E‑Business Suite (12.2.3–12.2.15).
  • Enforce strict least‑privilege controls on the servers hosting the stack, ensuring that only trusted administrators can log in with high privileges.
  • Conduct a comprehensive review of all local administrative accounts associated with the infrastructure, disabling or removing any that are unnecessary.

Generated by OpenCVE AI on August 4, 2026 at 02:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 03:15:00 +0000

Type Values Removed Values Added
Title Local Privileged Configuration Modification Vulnerability in Oracle Applications Technology Stack

Thu, 30 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Title Local Privileged Configuration Modification Vulnerability in Oracle Applications Technology Stack

Tue, 28 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Title High Privilege Data Modification via Local Oracle Applications Technology Stack Vulnerability
Weaknesses CWE-862

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 23 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
Title High Privilege Data Modification via Local Oracle Applications Technology Stack Vulnerability
Weaknesses CWE-284
CWE-862

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Applications Technology Stack product of Oracle E-Business Suite (component: Configuration). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Applications Technology Stack executes to compromise Oracle Applications Technology Stack. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Applications Technology Stack accessible data as well as unauthorized access to critical data or complete access to all Oracle Applications Technology Stack accessible data. CVSS 3.1 Base Score 5.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle applications Technology Stack
CPEs cpe:2.3:a:oracle:applications_technology_stack:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle applications Technology Stack
References
Metrics cvssV3_1

{'score': 5.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Applications Technology Stack
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-24T15:22:25.353Z

Reserved: 2026-07-08T15:51:55.588Z

Link: CVE-2026-60762

cve-icon Vulnrichment

Updated: 2026-07-24T15:04:30.472Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-21T22:18:15.610

Modified: 2026-08-03T16:12:04.627

Link: CVE-2026-60762

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T03:00:02Z

Weaknesses