OracleCVE-2026-60989

Oracle Advanced Collections: takeover via Internal Operations

CVE-2026-60989 · Published Jul 21, 2026 · updated Aug 17, 2026

High8.8

No fix yet

Vulnerability in the Oracle Advanced Collections product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Collections. Successful attacks of this vulnerability can result in takeover of Oracle Advanced Collections. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Affected versions

Package	Affected	Fixed in
Oracle Advanced Collections Product	>= 12.2.3, <= 12.2.15	No fix yet

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-269, CWE-284, CWE-287, CWE-306

More Oracle advisories

All Oracle

High 7.8Jul 21

Oracle HRMS (US): takeover via Internal OperationsCVE-2026-62561no fix yet Medium 6.5Jul 21

Oracle HRMS (US): data exposure via Internal OperationsCVE-2026-62562no fix yet Medium 5.4Jul 21

Oracle Work in Process: data tampering via Internal OperationsCVE-2026-62563no fix yet High 7.1Jul 21

Oracle HRMS (US): data tampering via US Payroll Year EndCVE-2026-62565no fix yet High 7.7Jul 21

Oracle HRMS (UK): data exposure via UK PayrollCVE-2026-62567no fix yet High 7.8Jul 21

Oracle Java SE: takeover via InstallCVE-2026-62574no fix yet