What is the CVSS score of CVE-2026-60573?

CVE-2026-60573 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Oracle Partner Management CVE-2026-60573

EUVD-2026-46935 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-fjrm-jcpp-g5qv

Authentication Bypass Denial Of Service Oracle E Business Suite

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Vendor vector is consistent with description: HTTPS-accessible web component, no complexity barrier, low-privileged account required, no user interaction, partial CIA impacts, no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:07 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Partner Dashboard). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Partner Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Partner Management accessible data as well as unauthorized read access to a subset of Oracle Partner Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Partner Management. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Partial confidentiality, integrity, and availability compromise in Oracle Partner Management's Partner Dashboard component (E-Business Suite 12.2.3-12.2.15) is reachable over HTTPS by any low-privileged account holder without user interaction. Successful exploitation allows unauthorized read access to a subset of partner data, unauthorized modification or insertion of records, and partial denial of service against the affected component. No public exploit code or CISA KEV listing exists at time of analysis; the July 2026 Oracle Critical Patch Update addresses the issue.

Technical ContextAI

Oracle E-Business Suite (EBS) is a broad enterprise resource planning platform; the Partner Management module provides channel partner lifecycle management through a web-based portal. The Partner Dashboard component is exposed over HTTPS, placing the vulnerability squarely in the application's web tier. No CWE was assigned by Oracle or NVD, limiting precise root-cause classification; however, the CVSS profile - low privilege required, no user interaction, mixed partial CIA impacts at network scope - is consistent with patterns commonly seen in Oracle EBS access-control or authorization-bypass findings (CWE-284 / CWE-200 class). The vulnerability affects a contiguous version range spanning 12.2.3 through 12.2.15, covering multiple years of the EBS 12.2 release train. No CPE string was provided in the source data.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, documented at https://www.oracle.com/security-alerts/cpujul2026.html, which contains patches for CVE-2026-60573 across the affected 12.2.3-12.2.15 version range. The exact patched release identifier is not independently confirmed from the provided data - consult the CPU advisory's patch availability table for the specific patch number applicable to your EBS version. As a compensating control prior to patching, restrict network access to the Partner Dashboard component to known trusted IP ranges (internal networks or specific partner IP allowlists) using network ACLs or a web application firewall, noting this may impact legitimate partner portal access. Additionally, audit active low-privileged partner accounts and deactivate any unused or dormant accounts to reduce the exploitable attack surface. These mitigations reduce exposure but do not eliminate the vulnerability.