What is the CVSS score of CVE-2026-60687?

CVE-2026-60687 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle Federal Financials CVE-2026-60687

EUVD-2026-47042 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-qh7g-fqcw-5r3q

Authentication Bypass Information Disclosure Oracle E Business Suite

6.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.8 MEDIUM

Vendor-assigned vector is well-supported: network HTTPS access, no auth, high complexity barrier, scope change to adjacent EBS modules, confidentiality-only impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:57 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle U.S. Federal Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle U.S. Federal Financials. While the vulnerability is in Oracle U.S. Federal Financials, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle U.S. Federal Financials accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized access to sensitive federal financial data is possible in Oracle U.S. Federal Financials (versions 12.2.3-12.2.15, part of Oracle E-Business Suite) via a network-accessible authentication bypass in the Internal Operations component. An unauthenticated remote attacker with network access over HTTPS can, under high-complexity conditions, bypass authentication controls to read critical or complete confidential data - with scope change impact extending to additional E-Business Suite products beyond the directly targeted component. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag and scope-change designation elevate concern for federal agency deployments.

Technical ContextAI

Oracle U.S. Federal Financials is a module within Oracle E-Business Suite (EBS) tailored for U.S. federal government financial management, including appropriations, budgeting, and compliance with federal accounting standards. The vulnerability resides in the Internal Operations component and is tagged as an Authentication Bypass (CWE not formally assigned by Oracle). The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C) indicates network exposure via HTTPS with no authentication prerequisite, but with elevated attack complexity - consistent with an authentication bypass that requires specific conditions or crafting to trigger. The Scope Change (S:C) metric confirms that a successful exploit can propagate confidentiality impact beyond the vulnerable component to other EBS modules or integrated Oracle products sharing the same application tier.

RemediationAI

Apply the patches issued in Oracle's Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPU patches are cumulative for E-Business Suite; organizations should apply the full CPU patch set applicable to their EBS version within the 12.2.3-12.2.15 range. The exact patched release version is not independently confirmed beyond the CPU advisory reference - verify the specific patch number against the Oracle support portal (My Oracle Support). If immediate patching is not feasible, compensating controls include restricting network access to the Internal Operations component via firewall rules or WAF policies to limit exposure to trusted IP ranges only, and enforcing HTTPS mutual TLS at the load balancer to add an authentication layer upstream. Note that WAF-based controls may not fully mitigate an authentication bypass targeting application-layer logic. Given the scope change risk, audit access controls on all EBS modules co-hosted with the vulnerable instance.