OracleCVE-2026-60670

Oracle Applications Technology Stack: takeover via Client System Analyzer

CVE-2026-60670 · Published Jul 21, 2026 · updated Aug 7, 2026

High8.1

No fix yet

Vulnerability in the Oracle Applications Technology Stack product of Oracle E-Business Suite (component: Client System Analyzer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Technology Stack. Successful attacks of this vulnerability can result in takeover of Oracle Applications Technology Stack. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected versions

Package	Affected	Fixed in
Oracle Applications Technology Stack Product	>= 12.2.3, <= 12.2.15	No fix yet

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-284, CWE-306

More Oracle advisories

All Oracle

High 7.8Jul 21

Oracle HRMS (US): takeover via Internal OperationsCVE-2026-62561no fix yet Medium 6.5Jul 21

Oracle HRMS (US): data exposure via Internal OperationsCVE-2026-62562no fix yet Medium 5.4Jul 21

Oracle Work in Process: data tampering via Internal OperationsCVE-2026-62563no fix yet High 7.1Jul 21

Oracle HRMS (US): data tampering via US Payroll Year EndCVE-2026-62565no fix yet High 7.7Jul 21

Oracle HRMS (UK): data exposure via UK PayrollCVE-2026-62567no fix yet High 7.8Jul 21

Oracle Java SE: takeover via InstallCVE-2026-62574no fix yet