Raw vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-60891 is a low-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Oracle Work In Process. Its CVSS base score is 1.9 (Low).
Operationally, ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-47167
Vulnerability Data
Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Work in Process…
more
executes to compromise Oracle Work in Process. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Work in Process accessible data. CVSS 3.1 Base Score 1.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N).
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5)
Our mappings, made for this CVE.
Access enforcement directly stops unauthorized actors from obtaining sensitive information.
Information flow enforcement structurally prevents sensitive data from reaching unauthorized recipients.
Protection of information at rest prevents unauthorized exposure of stored sensitive data.
Transmission confidentiality mechanisms stop exposure of sensitive data on the wire.
Least privilege reduces the set of actors who can reach sensitive information.
Mitigating Controls (ISO/IEC 27001:2022 Annex A)
Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→ISO cross-walk — links open the control.
Suppressing system details, error specifics, and previous log-on information until successful authentication reduces the information an unauthenticated attacker can gather.
Secure delivery, protected storage, and confidentiality of allocation records limit exposure of authentication material to unauthorized observers.
Penetration testing and vulnerability scanning are performed to discover unintended exposure of sensitive data resulting from misconfigurations or coding errors.
Restricting anonymous or unknown access and encrypting high-value information limits the exposure of sensitive data that would otherwise be obtainable by unauthorized actors.
By requiring removal or masking of sensitive operational data before it enters test environments, the control sharply reduces the chance that such data will be exposed to unauthorized actors who have access to those environments.
Regular review of supplier audit trails, incident reports and service records reduces the likelihood that sensitive data will remain exposed through inadequate handling by the supplier.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.