What is the CVSS score of CVE-2026-60694?

CVE-2026-60694 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Enterprise Asset Management CVE-2026-60694

EUVD-2026-47048 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-894r-q5g8-9q2m

Authentication Bypass Oracle Enterprise Asset Management

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-delivered via HTTP, low complexity; PR:L confirmed by 'low privileged attacker' description; UI:R by required third-party interaction; scope change and C:L/I:L match described partial read/write impact with no availability loss.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:56 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Asset Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Asset Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Asset Management accessible data as well as unauthorized read access to a subset of Oracle Enterprise Asset Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

AnalysisAI

Cross-site scripting or authorization bypass in Oracle Enterprise Asset Management (E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 enables a low-privileged authenticated attacker to read a subset of accessible data and perform unauthorized write operations, with confirmed scope change that may impact additional E-Business Suite products. The attack is network-delivered via HTTP and requires a victim user to interact, consistent with a stored or reflected XSS-class injection despite the tag indicating authentication bypass. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the medium-severity tier warranting patch prioritization for internet-facing or multi-tenant E-Business Suite deployments.

Technical ContextAI

Oracle Enterprise Asset Management (EAM) is a module within Oracle E-Business Suite (EBS), a large integrated ERP platform. The affected component is 'Internal Operations,' which handles asset lifecycle workflows accessible via HTTP. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C) is structurally consistent with a stored or reflected cross-site scripting (XSS) or similar client-side injection flaw - a low-privileged user injects malicious content, which is later rendered and executed in another user's browser session, causing the scope change (S:C) that impacts the broader EBS application context. The tag 'Authentication Bypass' may indicate that the injected payload allows the attacker's session to act with escalated privileges of the interacting victim. The CWE field is listed as N/A by Oracle, which is common for Oracle CPU advisories that do not publish granular root-cause classifications. Affected CPE scope covers Oracle EBS EAM versions 12.2.3 through 12.2.15.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, which addresses this vulnerability as disclosed at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publicly document exact patch version numbers in the CPU summary table; organizations should use My Oracle Support (MOS) to identify the specific patch bundle applicable to their EBS release and verify patch applicability against their installed EAM version (12.2.3-12.2.15). If immediate patching is not feasible, compensating controls should include restricting low-privileged user access to the Internal Operations component in EAM via Oracle function security (menu exclusions or function restrictions), monitoring HTTP access logs to the EAM internal operations URLs for anomalous activity, and ensuring that higher-privileged users avoid clicking links or viewing content sourced from untrusted low-privileged accounts. These controls reduce but do not eliminate risk. No vendor-documented workaround short of patching is available from the published advisory.