PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-60788 Oracle CVE debrief

A vulnerability exists in Oracle Sales Offline, a component of Oracle E-Business Suite. The affected versions are 12.2.3 through 12.2.15. This vulnerability is easily exploitable by a low-privileged attacker with network access via HTTP, potentially leading to unauthorized data access, modification, and partial denial of service. The vulnerability has a CVSS 3.1 Base Score of 8.3, indicating high severity. Organizations should prioritize patching this vulnerability to prevent potential exploitation. The CVE record and NVD entry provide additional context.

Vendor
Oracle
Product
Sales Offline
CVSS
HIGH 8.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-27
Advisory published
2026-07-21
Advisory updated
2026-07-27

Who should care

Organizations using Oracle Sales Offline versions 12.2.3 through 12.2.15 should prioritize patching this vulnerability to prevent potential exploitation. This is due to the high CVSS score and potential impact on data integrity and availability. Security teams and operators should review the CVE record and NVD entry for further details.

Technical summary

The vulnerability in Oracle Sales Offline allows a low-privileged attacker with network access via HTTP to compromise the system. Successful attacks can result in unauthorized creation, deletion, or modification of critical data, unauthorized access to critical data, and partial denial of service. The CVSS 3.1 Base Score is 8.3, indicating high severity. This information is based on the CVE record and NVD entry.

Defensive priority

High priority should be given to patching this vulnerability due to its high CVSS score and potential impact on data integrity and availability.

Recommended defensive actions

  • Apply the latest patches from Oracle as soon as possible
  • Review and update network access controls to limit exposure
  • Monitor systems for unusual activity
  • Consider implementing compensating controls if patching is not immediately feasible
  • Review relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-21T22:18:17.847Z and was last modified on 2026-07-27T17:33:26.663Z. The NVD entry is currently Analyzed. This information is based on the NVD entry and the CVE record. The vulnerability affects Oracle Sales Offline, a component of Oracle E-Business Suite, with versions 12.2.3 through 12.2.15 being vulnerable. The CVE record and NVD entry provide further details.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-60788 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-60788

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-60788 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-60788

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.