CVE-2026-60573: Medium severity Oracle Oracle E-Business Suite vulnerability
Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Partner Dashboard). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Partner Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Partner Management accessible data as well as unauthorized read access to a subset of Oracle Partner Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Partner Management. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to Oracle Partner Management over HTTPS so only trusted sources/users can reach the Partner Dashboard.
Event History
Frequently Asked Questions
Which deployments are affected?
Oracle E-Business Suite deployments using the Oracle Partner Management Partner Dashboard component are affected if they run a supported version from 12.2.3 through 12.2.15.
What access does an attacker need?
An attacker needs network access to the affected service over HTTPS and a low-privileged account. No user interaction is required, and the attack complexity is rated low.
What could a successful attacker do?
A successful attacker could read a subset of accessible Oracle Partner Management data, modify, insert, or delete some accessible data, and cause a partial denial of service in Oracle Partner Management.