What is the CVSS score of CVE-2026-60685?

CVE-2026-60685 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle iSupport CVE-2026-60685

EUVD-2026-47040 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-vfc6-hcgf-f36v

Authentication Bypass Oracle E Business Suite

6.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-accessible with no authentication required; user interaction is mandatory; scope change into adjacent EBS components is confirmed; no availability impact applies per description.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:57 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iSupport, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle iSupport accessible data as well as unauthorized read access to a subset of Oracle iSupport accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

AnalysisAI

Cross-site injection in Oracle iSupport (E-Business Suite component) versions 12.2.3 through 12.2.15 enables unauthenticated remote attackers to compromise both iSupport and additional EBS components via HTTP. The CVSS scope change (S:C) combined with the 'Authentication Bypass' tag indicates the vulnerability can break out of iSupport's security boundary into adjacent Oracle EBS products, enabling unauthorized read and write access to application data. No public exploit code or CISA KEV listing exists at time of analysis; exploitation requires a victim user to interact with attacker-controlled content.

Technical ContextAI

Oracle iSupport is a web-based self-service customer support portal embedded within Oracle E-Business Suite (EBS) 12.2.x, providing ticket management, knowledge base, and account management capabilities through the Internal Operations component. The CVSS profile - AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - is characteristic of a client-side injection vulnerability such as reflected or stored cross-site scripting (XSS), consistent with the 'Authentication Bypass' tag, which typically signals that such flaws enable session token theft or cross-origin action execution. The scope change (S:C) reflects that the vulnerable iSupport component shares a browser/session context with other Oracle EBS applications, meaning a successful exploit can pivot beyond iSupport itself. CWE was not specified by the vendor, leaving root cause class to be inferred from the CVSS vector.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, available via the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched build version was not independently confirmed beyond the CPU reference - follow Oracle's My Oracle Support documentation for EBS 12.2.x patch application procedures. As a compensating control while patches are staged, restrict external network access to Oracle iSupport's Internal Operations endpoints at the perimeter or WAF layer, and deploy WAF rules targeting reflected injection patterns in HTTP parameters. Note that perimeter restrictions may degrade customer self-service functionality; prioritize patching over long-term WAF reliance. The 'Authentication Bypass' tag suggests session-related payload delivery should also be monitored through SIEM for anomalous iSupport session activity.