What is the CVSS score of CVE-2026-60739?

CVE-2026-60739 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle Field Service are affected by CVE-2026-60739?

Oracle Field Service (E-Business Suite versions 12.2.3-12.2.15) contains an authentication bypass allowing low-privileged users to read all Field Service data and make limited unauthorized…

How to fix or mitigate CVE-2026-60739?

Within 24 hours: inventory all production Oracle EBS Field Service instances running versions 12.2.3 through 12.2.15 and audit current user access logs for anomalous activity. Within 7 days: implement role-based access controls to restrict Field Service functionality to essential users only, enable audit logging on all data access and modifications, and establish monitoring for unauthorized data exports or unusual query patterns. Within 30 days: contact Oracle support to confirm upgrade availability to versions 12.2.16 or later and establish a patching timeline; if upgrade is unavailable, implement network segmentation to restrict Field Service connectivity to a limited set of authenticated users.

Oracle Field Service CVE-2026-60739

EUVD-2026-47075 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-5ccx-97c8-xrh3

Authentication Bypass Oracle Field Service

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Network HTTP access with a low-privilege account and no user interaction (AV:N/AC:L/PR:L/UI:N); full data read (C:H), partial modification (I:L), no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:09 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Field Service. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Field Service accessible data as well as unauthorized update, insert or delete access to some of Oracle Field Service accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).

AnalysisAI

Unauthorized data access in Oracle Field Service (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, remotely authenticated attacker to read all Field Service-accessible data and make limited unauthorized modifications over HTTP. Rated CVSS 3.1 7.1 (high) with high confidentiality and low integrity impact, the flaw is described by Oracle as easily exploitable and is tagged as an authentication bypass. There is no public exploit identified at time of analysis, it is not on CISA KEV, and no EPSS score was supplied.

Technical ContextAI

Oracle Field Service is a field workforce management module within Oracle E-Business Suite (EBS), a large integrated ERP/CRM suite widely deployed by enterprises for back-office and operations. The affected 'Internal Operations' component handles server-side business logic exposed over HTTP within the EBS application tier. No CWE was assigned (CWE: N/A) and Oracle does not publish root-cause detail, but the 'Authentication Bypass' tag combined with a PR:L / C:H vector suggests an access-control or authorization weakness that lets a user with a valid low-privilege account reach data or operations beyond their intended scope, rather than a memory-safety or injection defect. The affected versions form the 12.2.x EBS release line (12.2.3-12.2.15), and remediation is delivered through Oracle's quarterly Critical Patch Update mechanism.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships EBS security fixes through the quarterly CPU rather than as a single tagged product version, so identify and install the specific CPU patch for your 12.2.x Field Service deployment from that advisory (Patch available per vendor advisory - no standalone fix version was provided in the input). Until patched, restrict network reachability of the EBS application tier so the Field Service HTTP endpoints are not exposed to untrusted networks or the internet, and tighten provisioning and review of low-privilege Field Service accounts since the attack requires only low privileges; both controls reduce exposure but may inconvenience legitimate remote or third-party users. Because impact is primarily confidentiality of Field Service data, also increase monitoring of anomalous data-access patterns by low-privilege users as a detective control while patching is scheduled.