CVE-2026-60759: High severity Oracle Oracle Internet Procurement Connector vulnerability
Vulnerability in the Oracle Internet Procurement Connector product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Internet Procurement Connector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Internet Procurement Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Internet Procurement Connector accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle Internet Procurement Connector (Oracle E-Business Suite) - Internal Operationsto a version that resolves this vulnerability.Fixed in 12.2.3-12.2.15 - Compensating control
Restrict network access to the Oracle Internet Procurement Connector HTTP interface so unauthenticated attackers with network access cannot reach it.
Event History
Frequently Asked Questions
Which deployments are affected?
Oracle Internet Procurement Connector deployments running supported versions 12.2.3 through 12.2.15 are affected. The vulnerable component is Internal Operations.
Does exploitation require authentication or user interaction?
No. An unauthenticated attacker with network access over HTTP can attempt exploitation, and no user interaction is required; however, the vulnerability is rated difficult to exploit.
What could a successful attacker access or change?
Successful exploitation can allow unauthorized creation, deletion, or modification of critical data or all data accessible to Oracle Internet Procurement Connector. It can also allow unauthorized access to critical data or complete access to all connector-accessible data.