PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-60799 Oracle Corporation CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:18:18.533Z and has not been modified since then. CVE-2026-60799 is a vulnerability in Oracle Compensation Workbench, a component of Oracle E-Business Suite. The affected versions are 12.2.3-12.2.15. This easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle Compensation Workbench. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle Compensation Workbench accessible data, as well as unauthorized update, insert, or delete access to some of Oracle Compensation Workbench accessible data. The CVSS 3.1 Base Score is 7.1, indicating high severity with Confidentiality and Integrity impacts. Organizations should review and apply Oracle's security patches for CVE-2026-60799. Security teams and administrators responsible for Oracle E-Business Suite should verify their inventory and ensure that compensating controls are in place to mitigate potential risks.

Vendor
Oracle Corporation
Product
Oracle Compensation Workbench
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-08-07
Advisory published
2026-07-21
Advisory updated
2026-08-07

Who should care

Organizations using Oracle E-Business Suite versions 12.2.3-12.2.15 should prioritize patching CVE-2026-60799. Security teams and administrators responsible for Oracle E-Business Suite should review and apply the necessary security patches. IT teams managing Oracle E-Business Suite installations should verify their inventory and ensure that compensating controls are in place to mitigate potential risks.

Technical summary

CVE-2026-60799 is a vulnerability in the Oracle Compensation Workbench product of Oracle E-Business Suite. The affected versions are 12.2.3-12.2.15. This easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle Compensation Workbench. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle Compensation Workbench accessible data, as well as unauthorized update, insert, or delete access to some of Oracle Compensation Workbench accessible data. The CVSS 3.1 Base Score is 7.1, indicating high severity with Confidentiality and Integrity impacts.

Defensive priority

Oracle E-Business Suite vulnerability CVE-2026-60799 allows low-privileged attackers to compromise Compensation Workbench, potentially leading to unauthorized data access and modifications.

Recommended defensive actions

  • Review and apply Oracle's security patches for CVE-2026-60799
  • Restrict network access to Oracle Compensation Workbench
  • Monitor for suspicious activity on Oracle E-Business Suite
  • Implement compensating controls for data access and modifications
  • Verify and update inventory of Oracle E-Business Suite installations

Evidence notes

The CVE-2026-60799 vulnerability affects Oracle E-Business Suite versions 12.2.3-12.2.15. It allows low-privileged attackers with network access via HTTP to compromise Oracle Compensation Workbench, potentially leading to unauthorized access to critical data or complete access to all Oracle Compensation Workbench accessible data as well as unauthorized update, insert or delete access to some of Oracle Compensation Workbench accessible data. The CVSS 3.1 Base Score is 7.1 (Confidentiality and Integrity impacts).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-60799 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-60799

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-60799 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-60799

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.