CVE-2026-60945 Oracle CVE debrief

Who should care

Organizations using Oracle Learning Management versions 12.2.3-12.2.15 should prioritize patching this vulnerability. Security teams and administrators responsible for Oracle E-Business Suite and Learning Management systems should review and apply the necessary security patches.

Technical summary

The CVE-2026-60945 vulnerability is in the Oracle Learning Management product of Oracle E-Business Suite, specifically in the Internal Operations component. It affects versions 12.2.3-12.2.15 and has a CVSS 3.1 Base Score of 7.3, indicating high severity. The vulnerability allows low-privileged attackers with network access via HTTP to compromise the system, requiring human interaction. Successful attacks can result in unauthorized creation, deletion, or modification of critical data and unauthorized access to critical or all accessible data.

Defensive priority

Oracle Learning Management vulnerability allows low-privileged attackers to compromise data integrity and confidentiality.

Recommended defensive actions

• Review and apply Oracle's security patches for Learning Management versions 12.2.3-12.2.15.
• Restrict network access to Learning Management systems to only necessary personnel.
• Monitor Learning Management systems for suspicious activity.
• Implement additional authentication and authorization measures for Learning Management users.
• Conduct regular security audits and vulnerability assessments for Learning Management systems.

Evidence notes

The CVE-2026-60945 vulnerability affects Oracle Learning Management versions 12.2.3-12.2.15. It allows low-privileged attackers with network access via HTTP to compromise the system, requiring human interaction. Successful attacks can result in unauthorized creation, deletion, or modification of critical data and unauthorized access to critical or all accessible data. The CVSS 3.1 Base Score is 7.3, indicating high severity.

Official resources