Raw vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-60888 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Oracle Work In Process. Its CVSS base score is 5.3 (Medium).
Operationally, ranked at the 24th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-47165
Vulnerability Data
Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Work in…
more
Process. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Work in Process accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5)
Our mappings, made for this CVE.
Access enforcement directly stops unauthorized actors from obtaining sensitive information.
Information flow enforcement structurally prevents sensitive data from reaching unauthorized recipients.
Protection of information at rest prevents unauthorized exposure of stored sensitive data.
Transmission confidentiality mechanisms stop exposure of sensitive data on the wire.
Least privilege reduces the set of actors who can reach sensitive information.
Mitigating Controls (ISO/IEC 27001:2022 Annex A)
Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→ISO cross-walk — links open the control.
Suppressing system details, error specifics, and previous log-on information until successful authentication reduces the information an unauthenticated attacker can gather.
Secure delivery, protected storage, and confidentiality of allocation records limit exposure of authentication material to unauthorized observers.
Penetration testing and vulnerability scanning are performed to discover unintended exposure of sensitive data resulting from misconfigurations or coding errors.
Restricting anonymous or unknown access and encrypting high-value information limits the exposure of sensitive data that would otherwise be obtainable by unauthorized actors.
By requiring removal or masking of sensitive operational data before it enters test environments, the control sharply reduces the chance that such data will be exposed to unauthorized actors who have access to those environments.
Regular review of supplier audit trails, incident reports and service records reduces the likelihood that sensitive data will remain exposed through inadequate handling by the supplier.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.