Description
Vulnerability in the Oracle iReceivables product of Oracle E-Business Suite (component: AR Web Utilities). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iReceivables. Successful attacks of this vulnerability can result in takeover of Oracle iReceivables. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-21
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability in the Oracle iReceivables product of Oracle E‑Business Suite, specifically the AR Web Utilities component, allows a low‑privileged attacker with network access via HTTP to compromise the application. This flaw is easily exploitable and can lead to a full takeover of Oracle iReceivables, creating confidentiality, integrity and availability impacts as reflected by the CVSS 3.1 Base Score of 8.8.

Affected Systems

The affected product is Oracle iReceivables, with versions ranging from 12.2.3 to 12.2.15. The vulnerability is present in the AR Web Utilities component of these releases.

Risk and Exploitability

The EPSS score of less than 1% indicates a low probability of exploitation, but the high CVSS score suggests significant potential impact. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is over HTTP, requiring only network connectivity and a low‑privileged attacker.

Generated by OpenCVE AI on August 5, 2026 at 01:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle Security Patch published in the CPU July 2026 advisory for Oracle iReceivables to address the AR Web Utilities vulnerability.
  • Restrict HTTP access to the AR Web Utilities interface by limiting connections to trusted IP ranges or internal networks.
  • Verify that users and roles have the minimal permissions required for iReceivables and enforce proper role‑based access control to reduce the impact of any future exploitation.

Generated by OpenCVE AI on August 5, 2026 at 01:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 02:00:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Takeover in Oracle iReceivables AR Web Utilities
Weaknesses CWE-285

Tue, 04 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
Title Remote Takeover via AR Web Utilities in Oracle iReceivables
Weaknesses CWE-20
CWE-284

Thu, 30 Jul 2026 13:15:00 +0000

Type Values Removed Values Added
Title Remote Takeover via AR Web Utilities in Oracle iReceivables
Weaknesses CWE-20
CWE-284

Tue, 28 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Title Oracle iReceivables AR Web Utilities Remote Code Execution Vulnerability
Weaknesses CWE-284

Thu, 23 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
Title Oracle iReceivables AR Web Utilities Remote Code Execution Vulnerability
Weaknesses CWE-284

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle iReceivables product of Oracle E-Business Suite (component: AR Web Utilities). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iReceivables. Successful attacks of this vulnerability can result in takeover of Oracle iReceivables. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle ireceivables
CPEs cpe:2.3:a:oracle:ireceivables:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle ireceivables
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Ireceivables
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-24T15:21:08.595Z

Reserved: 2026-07-08T15:51:55.590Z

Link: CVE-2026-60783

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-07-21T22:18:17.260

Modified: 2026-07-29T15:26:07.197

Link: CVE-2026-60783

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T01:45:04Z

Weaknesses