OracleCVE-2026-60952

Oracle Transportation Execution: takeover via Internal Operations

CVE-2026-60952 · Published Jul 21, 2026 · updated Jul 29, 2026

High8.8

No fix yet

Vulnerability in the Oracle Transportation Execution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Transportation Execution. Successful attacks of this vulnerability can result in takeover of Oracle Transportation Execution. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Affected versions

Package	Affected	Fixed in
Oracle Transportation Execution Product	>= 12.2.3, <= 12.2.15	No fix yet

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-269, CWE-287, CWE-306

More Oracle advisories

All Oracle

High 7.8Jul 21

Oracle HRMS (US): takeover via Internal OperationsCVE-2026-62561no fix yet Medium 6.5Jul 21

Oracle HRMS (US): data exposure via Internal OperationsCVE-2026-62562no fix yet Medium 5.4Jul 21

Oracle Work in Process: data tampering via Internal OperationsCVE-2026-62563no fix yet High 7.1Jul 21

Oracle HRMS (US): data tampering via US Payroll Year EndCVE-2026-62565no fix yet High 7.7Jul 21

Oracle HRMS (UK): data exposure via UK PayrollCVE-2026-62567no fix yet High 7.8Jul 21

Oracle Java SE: takeover via InstallCVE-2026-62574no fix yet