CVE-2026-60670: oracle corporation oracle applications technology stack Improper Access Control

Vulnerability summary

CVE-2026-60670 is a high (CVSS 8.1) Improper Access Control vulnerability in oracle corporation oracle applications technology stack. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 33.4% of scored vulnerabilities.

Timeline

1. 21-07-2026
   PublishedVulnerability first disclosed.
2. 24-07-2026
   Last modifiedVulnerability information updated.

Description

Vulnerability in the Oracle Applications Technology Stack product of Oracle E-Business Suite (component: Client System Analyzer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Technology Stack. Successful attacks of this vulnerability can result in takeover of Oracle Applications Technology Stack. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
• CWE-306Missing Authentication for Critical FunctionalityThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.