What is the CVSS score of CVE-2026-60724?

CVE-2026-60724 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle E-Business Suite CVE-2026-60724

EUVD-2026-47068 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-4ch2-m69x-g283

Authentication Bypass Oracle Customer Interaction History

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-accessible HTTP component requiring a valid low-privilege session; partial confidentiality and integrity impact only, no availability impact, no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:53 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: Outcome-Result). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Customer Interaction History. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Customer Interaction History accessible data as well as unauthorized read access to a subset of Oracle Customer Interaction History accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Unauthorized data access and modification in Oracle Customer Interaction History (part of Oracle E-Business Suite) allows a network-adjacent low-privileged attacker to read a subset of confidential records and perform unauthorized insert, update, or delete operations via HTTP. Affected deployments span versions 12.2.3 through 12.2.15. The vulnerability was disclosed as part of Oracle's Critical Patch Update for July 2026; no public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Oracle Customer Interaction History is a module within Oracle E-Business Suite (EBS) that tracks customer interactions, outcomes, and results used in CRM workflows. The affected component is 'Outcome-Result,' which manages the classification and logging of interaction dispositions. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates that the flaw is reachable over the network via HTTP without requiring elevated privileges, consistent with a web-tier component exposed through EBS's standard application server layer (typically Oracle HTTP Server / Oracle Application Framework). The tag 'Authentication Bypass' likely refers to an authorization bypass within the component rather than a full authentication bypass, as the CVSS PR:L metric requires the attacker to hold a valid low-privilege session - consistent with a user who can log into EBS but should not have access to the Outcome-Result data they are able to read or modify. CWE data was not provided, but based on the impact pattern (unauthorized read and write to a subset of data for a low-privileged authenticated user), the root cause class is most consistent with CWE-285 (Improper Authorization) or CWE-863 (Incorrect Authorization). Exact CPE strings are not supplied, but Oracle EBS 12.2.3 through 12.2.15 is the confirmed scope.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability in Oracle Customer Interaction History. Oracle CPUs are cumulative, so organizations should apply the full patch set rather than individual fixes. The specific patched version of EBS 12.2.x was not independently confirmed beyond the advisory reference - consult the Oracle Support note linked from the CPU for the exact patch ID and prerequisite patches. As a compensating control pending patch deployment, restrict HTTP access to the EBS Outcome-Result component at the network layer or application firewall to known, trusted internal IP ranges, which limits the attack surface to users already inside the trusted network. Additionally, review and tighten EBS user account privileges to enforce the principle of least privilege, ensuring that accounts without a business need for Customer Interaction History access are denied that role - this reduces the pool of potential low-privileged attackers. Be aware that network-layer restrictions do not eliminate the risk if EBS is accessible from a broad internal network or VPN.