CVE-2026-60763: oracle corporation oracle applications manager Improper Access Control
Vulnerability summary
CVE-2026-60763 is a high (CVSS 8.4) Improper Access Control vulnerability in oracle corporation oracle applications manager. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8% of scored vulnerabilities.
Timeline
- 21-07-2026PublishedVulnerability first disclosed.
- 24-07-2026Last modifiedVulnerability information updated.
Description
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Applications Manager executes to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST8.4HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.19%
Chance of exploitation in the next 30 days
Percentile
8%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.19% on 22-09-2026
Known exploited
Compare KEV catalogsNot in the CISA KEV catalog.
Not in the ENISA CNW catalog.
Not in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Oracle1 product
- applications_manager≥ 12.2.3, ≤ 12.2.15
Oracle corporation1 product
- oracle applications manager≥ 12.2.3, ≤ 12.2.15
2 vendors · 2 products
References
1 links- www.oracle.com/security-alerts/cpujul2026.htmlVendor Advisory