What is the CVSS score of CVE-2026-60703?

CVE-2026-60703 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Oracle Interaction Blending are affected by CVE-2026-60703?

Oracle E-Business Suite versions 12.2.3 through 12.2.15 contain a data compromise vulnerability (CVE-2026-60703, CVSS 7.1) allowing low-privileged local attackers to read, create, delete, or modify…

How to fix or mitigate CVE-2026-60703?

Within 24 hours, conduct a complete inventory of all systems running Oracle E-Business Suite versions 12.2.3 through 12.2.15 and identify which instances contain the vulnerable Interaction Blending component. Within 7 days, implement compensating controls by restricting local system logon access to essential administrative personnel only, deploy or enhance privileged access management (PAM) solutions for affected servers, and enable comprehensive logging and monitoring of local authentication attempts. Within 30 days, establish a migration timeline to upgrade affected systems to versions beyond 12.2.15 or implement persistent network-level compensating controls, monitor for any indicators of exploitation, and conduct access reviews to ensure controls remain effective.

Oracle Interaction Blending CVE-2026-60703

EUVD-2026-47053 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-f6hg-8j7x-xwfm

Authentication Bypass Oracle Interaction Blending

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.1 HIGH

Local logon needed (AV:L) with a low-privileged account (PR:L) and no user interaction; high data read/modify impact (C:H/I:H) but no availability effect (A:N).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:33 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle Interaction Blending product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Interaction Blending executes to compromise Oracle Interaction Blending. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Interaction Blending accessible data as well as unauthorized access to critical data or complete access to all Oracle Interaction Blending accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Interaction Blending (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with local logon access to the hosting infrastructure to read, create, delete, or modify all data accessible to the product. The flaw carries a CVSS 3.1 base score of 7.1 with high confidentiality and integrity impact but no availability impact, and no public exploit has been identified at time of analysis. It was disclosed by Oracle in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle Interaction Blending is a call-center/contact-center module of Oracle E-Business Suite (EBS) that coordinates blended inbound and outbound telephony interactions; the affected component is 'Internal Operations.' EBS is a large PL/SQL and Java-based ERP suite typically deployed on Oracle Database with Oracle WebLogic/Application Server. The CWE is listed as N/A by the source, so the precise root-cause class is not documented, but the impact profile (unauthorized data read plus create/delete/modify) combined with local access and low privileges is consistent with a broken access-control or authorization weakness within the module rather than a memory-safety bug. The supplied tag 'Authentication Bypass' hints at a broken authentication/authorization check, though this is not corroborated by the CVSS metrics, which require existing low-level privileges (PR:L).

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, which contains the fix across the affected 12.2.x E-Business Suite releases; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch numbers and per-release instructions, as Oracle distributes EBS fixes as CPU bundle patches rather than a single named release version. No exact fix version string was provided in the input, so cite the CPU patch rather than an invented version. As compensating controls until patching, restrict and audit interactive OS and application logon accounts on the servers running Interaction Blending (the flaw requires local logon), enforce least privilege so low-privileged accounts cannot reach the module, and monitor for anomalous data create/delete/modify activity within Interaction Blending; the trade-off is that tightening account access may disrupt legitimate contact-center operators, so validate role changes against business workflows before enforcing.