CVE-2026-60573 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle E-Business Suite versions 12.2.3-12.2.15 should prioritize patching this vulnerability. Low-privileged attackers with network access via HTTPS can exploit this vulnerability, potentially leading to data manipulation, unauthorized data access, and service disruption.

Technical summary

The vulnerability in Oracle Partner Management, a part of Oracle E-Business Suite, is easily exploitable and allows low-privileged attackers with network access via HTTPS to compromise the system. Successful exploitation can lead to unauthorized data modifications, read access to a subset of data, and partial denial of service. The CVSS Vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, with a Base Score of 6.3, categorizing it as a medium severity vulnerability.

Defensive priority

Apply patches or updates provided by Oracle to address the vulnerability in Oracle Partner Management within Oracle E-Business Suite versions 12.2.3-12.2.15. Restrict network access to the affected systems to minimize the attack surface. Monitor for suspicious activities that could indicate exploitation attempts.

Recommended defensive actions

• Apply patches or updates provided by Oracle to address the vulnerability.
• Restrict network access to the affected systems.
• Monitor for suspicious activities.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was published on 2026-07-21T22:17:57.600Z and was last modified on 2026-07-27T16:18:06.693Z. The NVD entry is currently Awaiting Analysis. Oracle has provided a security alert for this vulnerability.

Official resources