What is the CVSS score of CVE-2026-60688?

CVE-2026-60688 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Oracle Scheduler CVE-2026-60688

EUVD-2026-47043 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-34gq-5vmf-jf2j

Authentication Bypass Denial Of Service Oracle E Business Suite

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Vendor vector is accurate: PR:L reflects mandatory low-privilege authentication; tripled-low CIA and unchanged scope match described partial, bounded impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:57 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Scheduler product of Oracle E-Business Suite (component: Rules UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Scheduler. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Scheduler accessible data as well as unauthorized read access to a subset of Oracle Scheduler accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Scheduler. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Oracle E-Business Suite's Scheduler component (Rules UI) in versions 12.2.3 through 12.2.15 allows low-privileged, network-authenticated attackers to read restricted scheduling data, manipulate scheduling rules via unauthorized insert, update, or delete operations, and cause partial denial of service - all via HTTP without user interaction. Disclosed as part of Oracle's July 2026 Critical Patch Update, this vulnerability carries a CVSS 6.3 medium rating with no public exploit or CISA KEV listing identified at time of analysis.

Technical ContextAI

Oracle Scheduler is a job automation and workflow scheduling subsystem within Oracle E-Business Suite (EBS), a large-scale enterprise ERP platform. The vulnerable sub-component is the Rules UI, a web-facing interface for configuring scheduling rules. The CVSS vector (AV:N/AC:L/PR:L/UI:N) places this firmly in the category of web application authorization or access control flaws exploitable over HTTP, consistent with typical EBS web-tier vulnerabilities such as improper object-level authorization or insufficient privilege enforcement on data-modifying endpoints. No CWE classification was provided by Oracle or NVD, which limits root-cause class determination. Affected versions span the 12.2 family from 12.2.3 to 12.2.15. No CPE string was included in the available intelligence data.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. The advisory does not specify an exact patched release version in the data available for this analysis; consult the Oracle CPU documentation directly for the applicable E-Business Suite patch bundle identifier for the Scheduler/Rules UI component. As compensating controls pending patch application, restrict HTTP access to Oracle EBS to trusted internal networks or VPN-only segments to reduce the network-reachable attack surface (note this does not eliminate insider threat). Additionally, audit and minimize low-privilege user account assignments with access to the Scheduler Rules UI, and enable EBS access logging on the Rules UI endpoints to detect anomalous read or modification activity. These controls reduce exposure but do not remediate the underlying flaw.