CVE-2026-60748 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle General Ledger versions 12.2.3-12.2.15 should prioritize patching this vulnerability. High privileged attackers could exploit this vulnerability to compromise data integrity and confidentiality via HTTP, potentially impacting additional products.

Technical summary

The CVE-2026-60748 vulnerability is in the Oracle General Ledger product of Oracle E-Business Suite, specifically in the Internal Operations component. Supported versions that are affected are 12.2.3-12.2.15. This easily exploitable vulnerability allows high privileged attackers with network access via HTTP to compromise Oracle General Ledger. While the vulnerability is in Oracle General Ledger, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle General Ledger accessible data as well as unauthorized update, insert or delete access to some of Oracle General Ledger accessible data. The CVSS 3.1 Base Score is 7.6, indicating high severity, with Confidentiality and Integrity impacts. The CVSS Vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N.

Defensive priority

Oracle General Ledger vulnerability allows high privileged attackers to compromise data integrity and confidentiality via HTTP.

Recommended defensive actions

• Review and apply Oracle's security patches for General Ledger versions 12.2.3-12.2.15.
• Restrict network access to Oracle General Ledger to only necessary personnel.
• Monitor Oracle General Ledger logs for suspicious activity.
• Implement compensating controls to detect and prevent potential attacks.
• Verify the integrity of Oracle General Ledger data.

Evidence notes

The CVE-2026-60748 vulnerability affects Oracle General Ledger versions 12.2.3-12.2.15. It allows high privileged attackers with network access via HTTP to compromise the system, potentially impacting additional products. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle General Ledger accessible data, as well as unauthorized update, insert or delete access to some of Oracle General Ledger accessible data. The CVSS 3.1 Base Score is 7.6, indicating high severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.