cve-2026-60960
HIGH CVSS 8.8 opencve
Description
Vulnerability in the Oracle SDP Number Portability product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle SDP Number Portability executes to compromise Oracle SDP Number Portability. While the vulnerability is in Oracle SDP Number Portability, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle SDP Number Portability. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Timeline
- Published
- 2026-07-21 22:18 UTC
- Last Modified
- 2026-08-06
CVSS Details
CVSS details not available.
Affected Products
No product information available.
Weaknesses (CWE)
CVSS metrics
| Version | Base | Severity | Vector | Exploitability | Impact | Source |
|---|---|---|---|---|---|---|
| 3.1 | 8.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
mitre | ||
| 3.1 | 8.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
nvd | ||
| 3.1 | 8.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
opencve |
References
No references available.
Linked Vulnerabilities
{
"cve": "CVE-2026-60960",
"enrichment": {
"affected": [
{
"configurations": [
{
"platform": null,
"status": "affected",
"versions": {
"scheme": "semver",
"value": "[12.2.3,12.2.15]"
}
}
],
"enrichment": {
"confidence": 100.0,
"confidence_source": "manual",
"scores": [
{
"score": 100.0,
"source": "manual"
}
]
},
"original": {
"product": "Oracle SDP Number Portability",
"source": "cna",
"vendor": "Oracle Corporation"
},
"product": "sdp_number_portability",
"vendor": "oracle"
}
],
"created": "2026-07-23T20:38:28.679657+00:00",
"updated": "2026-08-04T02:30:02.486797+00:00",
"vendors": [
"oracle",
"oracle$PRODUCT$sdp_number_portability"
]
},
"epss": {
"score": 0.00161
},
"mitre": {
"cpes": [
"cpe:2.3:a:oracle:sdp_number_portability:*:*:*:*:*:*:*:*"
],
"created": "2026-07-21T21:37:35.423000+00:00",
"description": "Vulnerability in the Oracle SDP Number Portability product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle SDP Number Portability executes to compromise Oracle SDP Number Portability. While the vulnerability is in Oracle SDP Number Portability, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle SDP Number Portability. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {
"score": 8.8,
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
},
"cvssV4_0": {}
},
"mitre_repo_path": "cves/2026/60xxx/CVE-2026-60960.json",
"references": [
"https://www.oracle.com/security-alerts/cpujul2026.html"
],
"title": null,
"updated": "2026-07-24T15:28:00.554000+00:00",
"vendors": [
"oracle",
"oracle$PRODUCT$sdp_number_portability"
],
"weaknesses": []
},
"nvd": {
"cpes": [
"cpe:2.3:a:oracle:e-business_suite:*:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:service_delivery_platform_number_portability:-:*:*:*:*:*:*:*"
],
"created": "2026-07-21T22:18:30.223000+00:00",
"description": "Vulnerability in the Oracle SDP Number Portability product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle SDP Number Portability executes to compromise Oracle SDP Number Portability. While the vulnerability is in Oracle SDP Number Portability, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle SDP Number Portability. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {
"score": 8.8,
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
},
"cvssV4_0": {}
},
"nvd_repo_path": "2026/CVE-2026-60960.json",
"references": [
"https://www.oracle.com/security-alerts/cpujul2026.html"
],
"title": null,
"updated": "2026-08-06T15:28:33.200000+00:00",
"vendors": [
"oracle",
"oracle$PRODUCT$e-business_suite",
"oracle$PRODUCT$service_delivery_platform_number_portability"
],
"weaknesses": [
"CWE-284"
]
},
"opencve": {
"changes": [
{
"created": "2026-07-21T22:00:00+00:00",
"data": [
{
"details": {
"new": "Vulnerability in the Oracle SDP Number Portability product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle SDP Number Portability executes to compromise Oracle SDP Number Portability. While the vulnerability is in Oracle SDP Number Portability, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle SDP Number Portability. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).",
"old": null
},
"type": "description"
},
{
"details": [
"oracle",
"oracle$PRODUCT$sdp_number_portability"
],
"type": "first_time"
},
{
"details": {
"added": [
"cpe:2.3:a:oracle:sdp_number_portability:*:*:*:*:*:*:*:*"
],
"removed": []
},
"type": "cpes"
},
{
"details": {
"added": [
"oracle",
"oracle$PRODUCT$sdp_number_portability"
],
"removed": []
},
"type": "vendors"
},
{
"details": {
"added": [
"https://www.oracle.com/security-alerts/cpujul2026.html"
],
"removed": []
},
"type": "references"
},
{
"details": {
"added": {
"cvssV3_1": {
"score": 8.8,
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
}
},
"removed": {},
"updated": {}
},
"type": "metrics"
}
],
"id": "762012ec-864a-4f19-8562-59432190c7df"
},
{
"created": "2026-07-23T21:45:00+00:00",
"data": [
{
"details": {
"new": "Local Privilege Escalation in Oracle SDP Number Portability Enabling Full Application Takeover",
"old": null
},
"type": "title"
},
{
"details": {
"added": [
"CWE-284"
],
"removed": []
},
"type": "weaknesses"
}
],
"id": "83b3bf88-3bec-441d-9469-4b34f71fb49a"
},
{
"created": "2026-07-25T19:30:00+00:00",
"data": [
{
"details": {
"added": {
"ssvc": {
"options": {
"Automatable": "no",
"Exploitation": "none",
"Technical Impact": "total"
},
"version": "2.0.3"
}
},
"removed": {},
"updated": {}
},
"type": "metrics"
}
],
"id": "74960e88-ca42-46bd-a07a-544760dc9d2d"
},
{
"created": "2026-07-28T20:30:00+00:00",
"data": [
{
"details": {
"new": null,
"old": "Local Privilege Escalation in Oracle SDP Number Portability Enabling Full Application Takeover"
},
"type": "title"
}
],
"id": "4269e016-4b7b-4f53-869d-83e3e14d131d"
},
{
"created": "2026-07-30T12:30:00+00:00",
"data": [
{
"details": {
"new": "Local Privilege Low-Privileged Attack Allows Takeover of Oracle SDP Number Portability",
"old": null
},
"type": "title"
}
],
"id": "3bf645d8-3ba2-4651-996b-51b42d59a627"
},
{
"created": "2026-08-04T02:45:00+00:00",
"data": [
{
"details": {
"new": null,
"old": "Local Privilege Low-Privileged Attack Allows Takeover of Oracle SDP Number Portability"
},
"type": "title"
}
],
"id": "4cf54b6a-4eae-4c0a-a103-55a5b8edd008"
}
],
"cpes": {
"data": [
"cpe:2.3:a:oracle:e-business_suite:*:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:sdp_number_portability:*:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:service_delivery_platform_number_portability:-:*:*:*:*:*:*:*"
],
"providers": [
"mitre",
"nvd"
]
},
"created": {
"data": "2026-07-21T21:37:35.423000+00:00",
"provider": "mitre"
},
"description": {
"data": "Vulnerability in the Oracle SDP Number Portability product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle SDP Number Portability executes to compromise Oracle SDP Number Portability. While the vulnerability is in Oracle SDP Number Portability, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle SDP Number Portability. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).",
"provider": "mitre"
},
"metrics": {
"cvssV2_0": {
"data": {},
"provider": null
},
"cvssV3_0": {
"data": {},
"provider": null
},
"cvssV3_1": {
"data": {
"score": 8.8,
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
},
"provider": "mitre"
},
"cvssV4_0": {
"data": {},
"provider": null
},
"epss": {
"data": {
"score": 0.00161
},
"provider": "first"
},
"kev": {
"data": {},
"provider": null
},
"ssvc": {
"data": {
"options": {
"Automatable": "no",
"Exploitation": "none",
"Technical Impact": "total"
},
"version": "2.0.3"
},
"provider": "vulnrichment"
},
"threat_severity": {
"data": null,
"provider": null
}
},
"references": {
"data": [
"https://www.oracle.com/security-alerts/cpujul2026.html"
],
"providers": [
"mitre",
"nvd"
]
},
"title": {
"data": null,
"provider": null
},
"updated": {
"data": "2026-08-04T02:30:02.486797+00:00",
"provider": "enrichment"
},
"vendors": {
"data": [
"oracle",
"oracle$PRODUCT$e-business_suite",
"oracle$PRODUCT$sdp_number_portability",
"oracle$PRODUCT$service_delivery_platform_number_portability"
],
"providers": [
"mitre",
"nvd",
"enrichment"
]
},
"weaknesses": {
"data": [
"CWE-284"
],
"providers": [
"nvd",
"vulnrichment"
]
}
},
"vulnrichment": {
"cpes": [],
"created": "2026-07-21T21:37:35.423000+00:00",
"description": "Vulnerability in the Oracle SDP Number Portability product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle SDP Number Portability executes to compromise Oracle SDP Number Portability. While the vulnerability is in Oracle SDP Number Portability, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle SDP Number Portability. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {},
"cvssV4_0": {},
"kev": {},
"ssvc": {
"options": {
"Automatable": "no",
"Exploitation": "none",
"Technical Impact": "total"
},
"version": "2.0.3"
}
},
"references": [],
"title": null,
"updated": "2026-07-24T15:27:56.087000+00:00",
"vendors": [],
"vulnrichment_repo_path": "2026/60xxx/CVE-2026-60960.json",
"weaknesses": [
"CWE-284"
]
}
}