What is the CVSS score of CVE-2026-60587?

CVE-2026-60587 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Oracle Project Foundation CVE-2026-60587

EUVD-2026-46949 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-m6jp-3332-g884

Authentication Bypass Denial Of Service Oracle E Business Suite

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Network-accessible EBS HTTP endpoint requires low-privileged authentication (PR:L); partial tripartite impact (C:L/I:L/A:L) matches Oracle-described unauthorized read, write/delete, and partial DoS scope with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:05 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

MEDIUM 6.3

DescriptionCVE.org

Vulnerability in the Oracle Project Foundation product of Oracle E-Business Suite (component: Project Definition). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Foundation. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Project Foundation accessible data as well as unauthorized read access to a subset of Oracle Project Foundation accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Project Foundation. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Oracle Project Foundation's Project Definition component in E-Business Suite versions 12.2.3 through 12.2.15 allows any low-privileged authenticated user to exploit HTTP-accessible endpoints, resulting in unauthorized read, insert, update, or delete of project data and partial denial of service. Disclosed in Oracle's Critical Patch Update for July 2026 and described by Oracle as 'easily exploitable,' the flaw's low attack complexity and absence of required user interaction broaden the practical attacker population to any valid EBS credential holder. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS signal is available from the provided intelligence.

Technical ContextAI

Oracle Project Foundation is the project portfolio and lifecycle management module within Oracle E-Business Suite (EBS), a broadly deployed enterprise ERP platform. The specifically affected sub-component is Project Definition, which governs core project data structures, configurations, and lifecycle records within EBS - typically exposed through Oracle's HTTP-based application tier (Oracle Application Framework or OAF-based web endpoints). Affected versions span the entire supported 12.2.x release train from 12.2.3 through 12.2.15. No CWE classification was provided in the available intelligence, so the root-cause class cannot be confirmed; however, the combination of network-accessible low-complexity exploitation by a low-privileged user yielding partial impact across all three CIA dimensions in a data-access component is consistent with authorization or access control weaknesses such as improper privilege management, insecure direct object reference, or missing function-level access control - a pattern commonly observed in Oracle EBS advisory disclosures. No CPE strings were included in the provided data.

RemediationAI

The primary fix is to apply Oracle's Critical Patch Update for July 2026, which addresses CVE-2026-60587 across Oracle E-Business Suite 12.2.x. Oracle CPU patches are cumulative, so applying the July 2026 CPU resolves this and co-disclosed vulnerabilities. Consult the advisory at https://www.oracle.com/security-alerts/cpujul2026.html for specific patch numbers, pre-requisites, and installation procedures applicable to each 12.2.x sub-release in use. An exact patched version number was not independently confirmed from the available data beyond the advisory reference - verify the specific patch identifier via My Oracle Support (MOS) before deployment. Where immediate patching is not feasible, restrict access to the Project Definition component via Oracle EBS function-level security controls (menu exclusions, responsibility-based access) to limit which authenticated users can reach the affected endpoints, thereby reducing the exploitable user population. Note that this compensating control reduces but does not eliminate risk, as users who legitimately require Project Foundation access remain potentially exploitable. Additionally, restricting EBS HTTP access at the network layer to trusted internal segments reduces external attack surface but does not mitigate insider or compromised-credential scenarios.