What is the CVSS score of CVE-2026-60684?

CVE-2026-60684 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle E-Business Suite CVE-2026-60684

EUVD-2026-47039 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-7jq5-m4p2-vh3p

Authentication Bypass Oracle Applications Framework

4.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.6 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

vuln.today AI

4.6 MEDIUM

Network-accessible endpoint, low-complexity exploit, but requires authenticated low-privileged session and victim interaction; no availability impact per description.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:58 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Upload Attachments). Supported versions that are affected are 12.2.8-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data as well as unauthorized read access to a subset of Oracle Applications Framework accessible data. CVSS 3.1 Base Score 4.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N).

AnalysisAI

Unauthorized data manipulation in Oracle Applications Framework (Oracle E-Business Suite) versions 12.2.8 through 12.2.15 exposes the Upload Attachments component to low-privileged network attackers who can read and modify a subset of accessible application data. Exploitation requires human interaction from a third party, consistent with a cross-site request forgery or social-engineering-assisted vector. No public exploit code or CISA KEV listing has been identified at time of analysis; CVSS 3.1 base score of 4.6 (Medium) reflects limited impact scope with no availability impact.

Technical ContextAI

Oracle Applications Framework (OAF) is the underlying Java-based web application framework powering Oracle E-Business Suite (EBS), a large enterprise ERP platform. The affected component is 'Upload Attachments,' a file-handling subsystem common across EBS modules (AP, AR, HR, etc.). The CWE is not specified in the available data, but the 'Authentication Bypass' tag alongside PR:L and UI:R in the CVSS vector suggests either an improper authorization check (CWE-285) or a cross-site request forgery class flaw (CWE-352) in the attachment upload handler - where a low-privileged authenticated session can be leveraged to affect data beyond its authorization scope when a victim interacts with attacker-influenced content. Affected versions span the entire actively-supported 12.2.x long-term release stream (12.2.8 through 12.2.15) based on Oracle's CPU advisory and EUVD-2026-47039 metadata.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPU patches are cumulative within the 12.2.x release stream; an exact patched version number was not independently confirmed in the available data - consult the Oracle CPU advisory directly for the precise patch level to apply. As a compensating control prior to patching, restrict access to the Upload Attachments functionality at the application or network layer by limiting which user roles can reach the OAF attachment upload endpoint, though this may impact legitimate business workflows in modules that rely on document attachment features. Network-layer controls (WAF rules targeting the OAF upload endpoint) may reduce attack surface but will not fully mitigate an authenticated insider threat scenario. Monitor EBS access logs for anomalous attachment upload activity from low-privileged accounts.