CVE-2026-60941: High severity Oracle Oracle E-Business Suite vulnerability
Vulnerability in the Oracle Service Fulfillment Manager product of Oracle E-Business Suite (component: Fulfillment Engine). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Service Fulfillment Manager. While the vulnerability is in Oracle Service Fulfillment Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Service Fulfillment Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Service Fulfillment Manager accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs high privileges and network access to the affected Oracle Service Fulfillment Manager Fulfillment Engine through HTTP. No user interaction is required.
Which deployments are affected?
Affected supported versions are Oracle Service Fulfillment Manager 12.2.3 through 12.2.15. The provided information does not state whether any particular default configuration exposes the vulnerable component.
What could a successful attacker do?
A successful attacker can gain unauthorized access to critical data or all data accessible to Oracle Service Fulfillment Manager, and can create, modify, or delete that data. The scope change indicates that impacts may significantly affect additional products.