Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Sales Offline. While the vulnerability is in Oracle Sales Offline, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Sales Offline. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Oracle |
|
No data.
No data.
References
| Link | Providers |
|---|---|
| https://www.oracle.com/security-alerts/cpujul2026.html |
|
History
Wed, 05 Aug 2026 02:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | High-Privilege Remote Exploitation of Oracle Sales Offline Leads to System Takeover | |
| Weaknesses | CWE-285 |
Tue, 04 Aug 2026 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | High-Privilege Remote Takeover via HTTP in Oracle Sales Offline | |
| Weaknesses | CWE-284 |
Sat, 01 Aug 2026 05:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | High-Privilege Remote Takeover via HTTP in Oracle Sales Offline | |
| Weaknesses | CWE-284 |
Tue, 28 Jul 2026 21:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | High-Privilege Remote Code Execution Vulnerability in Oracle Sales Offline via HTTP | |
| Weaknesses | CWE-284 |
Thu, 23 Jul 2026 22:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | High-Privilege Remote Code Execution Vulnerability in Oracle Sales Offline via HTTP | |
| Weaknesses | CWE-284 |
Tue, 21 Jul 2026 22:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Sales Offline. While the vulnerability is in Oracle Sales Offline, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Sales Offline. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H). | |
| First Time appeared |
Oracle
Oracle sales Offline |
|
| CPEs | cpe:2.3:a:oracle:sales_offline:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Oracle
Oracle sales Offline |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: oracle
Published: 2026-07-21T21:36:57.626Z
Updated: 2026-07-24T15:26:57.408Z
Reserved: 2026-07-08T15:51:55.590Z
Link: CVE-2026-60790
Vulnrichment
No data.
NVD
No data.
Redhat
No data.