Description
Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Learning Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Learning Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Learning Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-07-21
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability in Oracle Learning Management’s Internal Operations component, classified as CWE‑284 (Improper Authorization), allows an attacker with low privileges that can reach the system over HTTP to create, delete, or modify critical data. The flaw can lead to unauthorized access to or destruction of all Oracle Learning Management data, jeopardising confidentiality and integrity of the system’s information.

Affected Systems

Oracle Learning Management, part of Oracle E‑Business Suite, is affected for version ranges 12.2.3 through 12.2.15. The vulnerability applies to the Internal Operations component and is reached via HTTP from the network.

Risk and Exploitability

The CVSS v3.1 base score of 8.1 indicates high severity with confidentiality and integrity impacts. The EPSS score of less than 1% suggests the risk of exploitation is low at present, and the vulnerability is not listed in CISA’s KEV catalog. An attacker would need network access to the Oracle Learning Management HTTP interface and low privileges; no advanced privileges or local access are required for the attack to succeed.

Generated by OpenCVE AI on August 4, 2026 at 02:17 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle security patch or upgrade to a supported release as per the July 2026 CPU
  • Restrict HTTP access to the Learning Management application to trusted network ranges or enforce authentication before use
  • Deploy network segmentation or firewall rules to block unauthenticated HTTP traffic to the Learning Management port
  • Monitor application logs for anomalous data modification attempts

Generated by OpenCVE AI on August 4, 2026 at 02:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 02:45:00 +0000

Type Values Removed Values Added
Title Improper Authorization in Oracle Learning Management Enables Low‑Privileged Data Tampering Over HTTP

Thu, 30 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification via Low-Privileged HTTP Access in Oracle Learning Management

Fri, 24 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification via Low-Privileged HTTP Access in Oracle Learning Management

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Learning Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Learning Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Learning Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle learning Management
CPEs cpe:2.3:a:oracle:learning_management:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle learning Management
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Learning Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-24T16:38:05.119Z

Reserved: 2026-07-08T15:51:55.603Z

Link: CVE-2026-60948

cve-icon Vulnrichment

Updated: 2026-07-24T16:37:57.371Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-21T22:18:29.380

Modified: 2026-07-29T16:46:29.710

Link: CVE-2026-60948

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T02:30:02Z

Weaknesses