CVE-2026-60845 Oracle Corporation CVE debrief

Who should care

Oracle E-Business Suite administrators, security teams, and IT personnel responsible for Oracle Mobile Application Server should review and apply Oracle's security patches for E-Business Suite versions 12.2.3-12.2.15. They should also restrict network access to Oracle Mobile Application Server to only necessary personnel and monitor for suspicious activity on Oracle Mobile Application Server. Additionally, they should verify and enforce strong authentication and authorization mechanisms for Oracle E-Business Suite users. IT personnel should track exceptions, retest remediated assets, and close the item only after evidence is documented. Vulnerability management and security teams should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. They should also review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Asset inventory management should be reviewed to identify potentially affected systems. Those responsible for Oracle E-Business Suite should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Monitoring, detection, and logs for exposed assets that need extra review should be checked. Source tracking should be implemented to monitor for potential exploitation attempts. Rollback/change windows should be considered for updates. Security teams should also review relevant monitoring, detection, and logs for exposed assets that need extra review. Those responsible for Oracle E-Business Suite should also verify and enforce strong authentication and authorization mechanisms for Oracle E-Business Suite users. They should also review compensating controls for exposed systems while remediation is scheduled and verified. IT personnel should track exceptions, retest remediated assets, and close the item only after evidence is documented. Vulnerability management and security teams should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. They sh

Technical summary

The CVE-2026-60845 vulnerability is in the Oracle Mobile Application Server product of Oracle E-Business Suite, specifically in the MWA General Bugs component. It has a CVSS score of 7.2 and is classified as HIGH. The vulnerability allows high privileged attackers with network access via HTTP to compromise Oracle Mobile Application Server, potentially leading to its takeover. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Application Server.

Defensive priority

High privileged attackers with network access via HTTP can compromise Oracle Mobile Application Server, potentially leading to its takeover.

Recommended defensive actions

• Review and apply Oracle's security patches for E-Business Suite versions 12.2.3-12.2.15
• Restrict network access to Oracle Mobile Application Server to only necessary personnel
• Monitor for suspicious activity on Oracle Mobile Application Server
• Verify and enforce strong authentication and authorization mechanisms for Oracle E-Business Suite users
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE-2026-60845 vulnerability affects Oracle E-Business Suite versions 12.2.3-12.2.15. It has a CVSS score of 7.2 and is classified as HIGH. The vulnerability is in the Oracle Mobile Application Server product, specifically in the MWA General Bugs component. The CVSS Vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. Defenders should verify the affected product deployments exist in managed environments and review compensating controls for exposed systems.

Official resources