What is the CVSS score of CVE-2026-60697?

CVE-2026-60697 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Oracle Site Hub CVE-2026-60697

EUVD-2026-47050 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-h8v2-8w9w-m82m

Authentication Bypass Denial Of Service Oracle E Business Suite

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

PR:L confirmed by low-privileged attacker requirement; AV:N by HTTP access; C/I/A:L reflect the described partial impacts across all three dimensions.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:56 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Site Hub product of Oracle E-Business Suite (component: Site Hierarchy Flows). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Site Hub. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Site Hub accessible data as well as unauthorized read access to a subset of Oracle Site Hub accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Site Hub. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Oracle Site Hub's Site Hierarchy Flows component in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes a medium-severity flaw accessible to low-privileged authenticated users over HTTP with no user interaction required. Successful exploitation yields partial unauthorized read access to Site Hub data, unauthorized insert, update, or delete capability against accessible data, and the ability to induce a partial denial of service within the application. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis; this vulnerability was disclosed as part of Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Site Hub is an Oracle E-Business Suite (EBS) module responsible for managing enterprise site and location master data, including hierarchical relationships between sites used across supply chain and procurement workflows. The Site Hierarchy Flows component specifically handles the workflow and navigation logic governing site hierarchy management via EBS's HTTP-based web interface. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates the flaw is reachable via standard HTTP with minimal complexity, requiring only low-level authenticated access. Oracle does not disclose CWE identifiers for CPU vulnerabilities as a matter of policy, so the root cause class - whether improper access control, insufficient authorization checks, injection, or another class - cannot be confirmed from available data. The affected version span (12.2.3-12.2.15) covers an extensive range of the 12.2 EBS release train, suggesting a persistent flaw within the Site Hierarchy Flows codebase rather than a regression introduced in a specific patch.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU), which addresses this vulnerability; the full advisory and patch matrix are available at https://www.oracle.com/security-alerts/cpujul2026.html. The specific patched build number beyond the CPU release is not stated in available source data - customers should consult My Oracle Support (MOS) for the exact patch identifier applicable to their EBS version and platform. As a compensating control pending patch deployment, restrict network access to the Oracle EBS HTTP interface to only authorized internal users and networks, reducing the population of accounts that could exploit the flaw. Enforce strict role-based access controls within EBS to ensure low-privileged accounts do not hold unnecessary access to Site Hierarchy Flows functionality. Note that Oracle CPU patches for EBS typically require validation in non-production environments due to potential functional interdependencies across EBS modules, so plan for a testing window before production deployment.