What is the CVSS score of CVE-2026-60710?

CVE-2026-60710 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle EDI Gateway are affected by CVE-2026-60710?

Oracle EDI Gateway (E-Business Suite 12.2.3-12.2.15) contains an authentication-bypass flaw allowing low-privileged attackers to read, create, delete, and modify all EDI data via HTTP access.

How to fix or mitigate CVE-2026-60710?

Within 24 hours: identify all affected Oracle E-Business Suite instances running EDI Gateway versions 12.2.3-12.2.15 and document data classification; confirm which low-privileged user accounts have EDI access. Within 7 days: restrict HTTP access to EDI Gateway via firewall rules to authorized internal networks only; implement application-level audit logging on all EDI data operations; enforce multi-factor authentication on all EDI user accounts. Within 30 days: establish real-time alerting on EDI data modification activities; request formal patch timeline from Oracle; prepare expedited deployment and change control procedures for emergency patching upon vendor release.

Oracle EDI Gateway CVE-2026-60710

EUVD-2026-47059 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-vm9x-8268-7w7w

Authentication Bypass Oracle E Business Suite

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Remotely reachable over HTTP with low complexity and no interaction, but requires a low-privilege account (PR:L); high confidentiality/integrity data impact and no availability effect (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:30 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle EDI Gateway. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle EDI Gateway accessible data as well as unauthorized access to critical data or complete access to all Oracle EDI Gateway accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle EDI Gateway (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read, create, delete, or modify all EDI Gateway-accessible data, including critical data. Rated CVSS 8.1, the flaw is disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication-bypass-class issue; no public exploit is identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle EDI Gateway is the Electronic Data Interchange integration module within Oracle E-Business Suite (Oracle's flagship ERP/business-application platform), used to translate and exchange business documents (purchase orders, invoices, shipment notices) between trading partners. The affected component is 'Internal Operations', reached over HTTP as part of the EBS application tier. Oracle assigns no CWE for this issue, but the vendor 'Authentication Bypass' tag combined with the CVSS profile (high confidentiality and integrity impact, no availability impact, low privileges required) points to a broken access-control / authorization weakness (CWE-284/CWE-863 class) that allows an authenticated but low-privileged user to reach data and operations beyond their intended authorization scope.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to all Oracle E-Business Suite 12.2 environments running EDI Gateway; Patch available per vendor advisory (Oracle does not publish a standalone semantic fix version - the CPU patch set is the deliverable, so no exact fix version is asserted here). Because Oracle CPU patches are cumulative, deploy the full July 2026 EBS 12.2 bundle rather than a partial fix. As compensating controls until patching, restrict network reachability of the EBS application tier and the EDI Gateway/Internal Operations endpoints to trusted internal networks or VPN only (trade-off: may break external trading-partner EDI integrations that rely on direct HTTP access), tighten authorization by auditing and minimizing low-privilege EBS accounts that can reach EDI Gateway (trade-off: possible workflow disruption for legitimate EDI operators), and increase monitoring/logging of EDI data create/modify/delete operations to detect abuse. Validate all changes in a non-production EBS instance first, as Oracle CPU patches can affect customizations.