CVE-2026-60950

LowCVSS 2.2

Published: 21/07/2026(UTC)Updated: 27/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

Vulnerability in Oracle HRMS (Ireland) product of Oracle E-Business Suite (component: Internal Operations) in versions 12.2.3-12.2.15. A difficult-to-exploit vulnerability allows a high-privileged attacker with network access via HTTP to gain unauthorized read access to a subset of Oracle HRMS (Ireland) data. CVSS 3.1 Base Score 2.2 (Confidentiality impact).

Risk Assessment

The organization is at risk of leakage of sensitive HR data (Ireland) by a high-privileged attacker, but due to the difficulty of exploitation, the risk is low.

Recommendation

Apply the patch available in the Oracle Critical Patch Update for the corresponding Oracle E-Business Suite version.

Original NVD description (English source)

Vulnerability in the Oracle HRMS (Ireland) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HRMS (Ireland). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle HRMS (Ireland) accessible data. CVSS 3.1 Base Score 2.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N).