Low severity · published Jul 21, 2026
CVE-2026-60891
Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations)
1.9
CVSS
0.1%
EPSS
No
On KEV
Description
Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Work in Process executes to compromise Oracle Work in Process. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Work in Process accessible data. CVSS 3.1 Base Score 1.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N).
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
High
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OW
Oracle Work in Process · Oracle Corporation
12.2.3 through 12.2.15 · source: vendor
WI
Work IN Process · Oracle
12.2.3 through 12.2.15 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-60891
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-60891
Vendor Advisory
https://www.oracle.com/security-alerts/cpujul2026.html
More from Oracle Work in Process
9.8
CVE-2026-60880
Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations)
8.8
CVE-2026-62462
Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations)
8.1
CVE-2026-83477
Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Workbenches)
8.1
CVE-2026-62451
Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations)
7.6
CVE-2026-60886
Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations)