What is the CVSS score of CVE-2026-60571?

CVE-2026-60571 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

Oracle SDP Number Portability CVE-2026-60571

EUVD-2026-46933 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-jjrr-3xfc-3354

Authentication Bypass Denial Of Service Oracle E Business Suite

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

Agrees with vendor vector: network-accessible via HTTP, low complexity, requires authenticated low-privileged account, no confidentiality impact, only partial integrity and availability degradation.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:07 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle SDP Number Portability product of Oracle E-Business Suite (component: Installation). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SDP Number Portability. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle SDP Number Portability accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle SDP Number Portability. CVSS 3.1 Base Score 5.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).

AnalysisAI

Oracle SDP Number Portability versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes a medium-severity flaw in its Installation sub-component that permits low-privileged authenticated network attackers to manipulate accessible data and partially disrupt service availability via HTTP. The CVSS 3.1 score of 5.4 reflects limited scope - no confidentiality impact and only partial integrity and availability degradation - with no confirmed active exploitation (not listed in CISA KEV) and no publicly available proof-of-concept at time of analysis. Oracle disclosed this vulnerability as part of the Critical Patch Update for July 2026, classifying it as 'easily exploitable' given the low attack complexity and absence of required user interaction.

Technical ContextAI

Oracle SDP (Service Delivery Platform) Number Portability is a specialized module within Oracle E-Business Suite designed to support telecommunications number portability workflows. The affected component is the 'Installation' sub-component, suggesting the vulnerability may reside in setup, configuration, or initialization routines exposed over HTTP. No CWE identifier was provided, making it impossible to definitively classify the root cause class; however, the combination of network accessibility, low privilege requirement, and data manipulation capability (unauthorized insert/update/delete) is consistent with improper authorization or access control weaknesses in installation-phase endpoints. Affected versions span 12.2.3 through 12.2.15 as confirmed by both Oracle and ENISA EUVD-2026-46933. No CPE strings were supplied in the intelligence data.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses CVE-2026-60571 for Oracle SDP Number Portability across affected versions 12.2.3 through 12.2.15. An exact patched release version was not independently confirmed beyond the CPU advisory reference - consult My Oracle Support for the specific patch identifier and installation instructions applicable to your E-Business Suite release. If immediate patching is not feasible, a compensating control would be to restrict network access to the SDP Number Portability Installation component endpoints at the network perimeter or application layer, limiting HTTP access to trusted administrative IP ranges only; note this trade-off may impact legitimate provisioning workflows. Additionally, review and enforce least-privilege principles for accounts with access to this module, as the attack requires a low-privileged authenticated session.