What is the CVSS score of CVE-2026-60736?

CVE-2026-60736 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60736?

A vulnerability in Oracle E-Business Intelligence's Definition component (CVE-2026-60736, CVSS 8.1) enables authenticated low-privileged users to read, create, delete, and modify critical business…

How to fix or mitigate CVE-2026-60736?

Within 24 hours, identify all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15 and document which systems contain sensitive business intelligence data; simultaneously assess current BI user access controls. Within 7 days, deploy Oracle's July 2026 Critical Patch Update to all affected production and staging instances and verify successful patch installation and system stability. Within 30 days, perform a data access audit to identify suspicious BI modifications, enforce least-privilege access controls on all BI data roles, and implement enhanced monitoring alerts for unauthorized BI data access or modifications.

Oracle E-Business Suite CVE-2026-60736

EUVD-2026-47073 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-wp4r-jf7v-r2qw

Authentication Bypass Oracle E Business Suite

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Remote HTTP vector with low complexity and a low-privilege authenticated account (PR:L); High confidentiality and integrity impact, no availability effect, scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:26 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle E-Business Intelligence product of Oracle E-Business Suite (component: Definition). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Intelligence. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle E-Business Intelligence accessible data as well as unauthorized access to critical data or complete access to all Oracle E-Business Intelligence accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthorized data compromise in Oracle E-Business Intelligence (Definition component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the product. The CVSS 3.1 vector (8.1) reflects High confidentiality and integrity impact with no availability effect, meaning an authenticated user can escalate their reach to critical business intelligence data without needing elevated roles. No public exploit identified at time of analysis, and the flaw is addressed in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle E-Business Suite is Oracle's integrated ERP/CRM application stack; E-Business Intelligence is its embedded analytics and reporting layer, and the affected 'Definition' component governs how BI report/metadata definitions are created and managed. The flaw resides in this web-facing (HTTP) tier and, per the supplied 'Authentication Bypass' tag combined with the CVSS PR:L metric, appears to let an already-authenticated low-privilege session act on data or definitions it should not control - a broken access control / privilege boundary weakness. No CWE was assigned in the input, so the precise root-cause class (e.g., missing function-level authorization) is inferred from the description rather than confirmed. Affected supported releases are the 12.2.x line (12.2.3-12.2.15); no CPE strings were provided in the intelligence, so exact platform CPEs could not be cross-referenced.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html); Oracle strongly recommends applying CPU patches without delay, and the exact per-product patch numbers are enumerated in that advisory's risk matrix rather than in this CVE record, so no specific fix build number is stated here to avoid inventing one. Because exploitation requires HTTP access with a low-privilege account, effective compensating controls until patching is complete include restricting network access to the E-Business Suite web tier to trusted networks or VPN (reducing internet exposure but potentially affecting remote user access), tightening EBS user provisioning and reviewing low-privilege role assignments that can reach E-Business Intelligence Definition functions, and monitoring EBS web/access logs for anomalous report-definition creation, deletion, or modification activity. If the affected E-Business Intelligence functionality is unused, consider disabling or restricting access to that module, accepting the trade-off of reduced reporting capability for lower attack surface.