What is the CVSS score of CVE-2026-60572?

CVE-2026-60572 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Oracle SOA Gateway CVE-2026-60572

EUVD-2026-46934 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-fvp4-8f5j-2mww

Authentication Bypass Denial Of Service Oracle E Business Suite

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Network-accessible HTTP service, low complexity, low-privilege credential required, no user interaction; all three impacts low and scope unchanged per description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:07 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: Web Service Provider). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle E-Business Suite Integrated SOA Gateway accessible data as well as unauthorized read access to a subset of Oracle E-Business Suite Integrated SOA Gateway accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Network-exploitable integrity, confidentiality, and availability compromise in Oracle E-Business Suite Integrated SOA Gateway (versions 12.2.3 through 12.2.15) allows low-privileged authenticated attackers over HTTP to read, modify, or partially disrupt accessible data within the Web Service Provider component. Oracle rates this CVSS 6.3 Medium, with all three security pillars impacted at a low level and no scope change beyond the affected component. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of required user interaction make this a credible threat for any internet- or intranet-reachable EBS deployment running the affected version range.

Technical ContextAI

Oracle E-Business Suite (EBS) Integrated SOA Gateway exposes internal EBS business logic as SOAP/REST web services via its Web Service Provider component, enabling integration with external systems. Versions 12.2.3 through 12.2.15 are confirmed affected per Oracle CPUJul2026. No CWE has been assigned by Oracle, which limits root-cause classification; however, the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) implies an authorization or input-validation flaw within the HTTP-accessible service layer, where a legitimately authenticated but low-privileged user can perform operations beyond their intended access boundaries. The component is part of Oracle's broader EBS suite used for enterprise resource planning (ERP) processes including finance, procurement, and supply chain.

RemediationAI

Apply the Oracle Critical Patch Update released July 2026, available via the Oracle Security Alerts advisory at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPUs deliver cumulative security fixes; customers on any version between 12.2.3 and 12.2.15 should upgrade to the patched release level specified in the July 2026 CPU. An exact patched version number was not independently confirmed from the available reference data - consult Oracle My Oracle Support (MOS) for the specific patch number and prerequisite patch requirements for your EBS release. As a compensating control, restrict network access to the Integrated SOA Gateway Web Service Provider endpoints at the perimeter firewall or reverse-proxy layer, limiting access to trusted integration hosts only; this reduces the attacker pool but does not eliminate risk if the threat is an internal low-privileged account. Additionally, audit accounts that hold SOA Gateway access grants and remove unnecessary privileges pending patch application.