What is the CVSS score of CVE-2026-60756?

CVE-2026-60756 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle EDI Gateway are affected by CVE-2026-60756?

Oracle EDI Gateway (versions 12.2.3-12.2.15), a core component of Oracle E-Business Suite handling supply chain and procurement transactions, is vulnerable to unauthenticated remote complete takeover…

How to fix or mitigate CVE-2026-60756?

Within 24 hours, identify all systems running Oracle EDI Gateway versions 12.2.3 through 12.2.15 and document their network exposure and business criticality, prioritizing systems that process payments or external supply chain communications. Within 7 days, implement network-layer protective controls including restricting EDI Gateway HTTP access to pre-approved trusted partner IP ranges, deploying Web Application Firewall (WAF) rules to detect and block exploitation attempts, and enabling enhanced monitoring with alerting for EDI Gateway access anomalies. Within 30 days, establish formal vendor communication with Oracle to confirm patch release timeline, evaluate upgrade feasibility to patched versions when released, and prepare migration or workaround strategies as contingency measures.

Oracle EDI Gateway CVE-2026-60756

EUVD-2026-47083 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-crcv-x9h3-m6gw

Authentication Bypass Oracle E Business Suite

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated HTTP-reachable component (AV:N/PR:N/UI:N) with vendor-confirmed difficult exploitation (AC:H) and full product takeover yielding complete CIA loss.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:06 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle EDI Gateway. Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle EDI Gateway (a component of Oracle E-Business Suite) is possible by an unauthenticated remote attacker over HTTP, affecting supported versions 12.2.3 through 12.2.15 per Oracle's July 2026 Critical Patch Update. Despite full confidentiality, integrity, and availability impact (CVSS 8.1), the CVSS vector rates attack complexity as high (AC:H), indicating exploitation is not trivial. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

Oracle EDI Gateway is the Electronic Data Interchange integration module within Oracle E-Business Suite (EBS), used to exchange structured business documents (purchase orders, invoices, shipment notices) between an organization's ERP and its trading partners. The affected 12.2.x branch is the Oracle EBS 12.2 release family, deployed on the Oracle Application Server / WebLogic middleware tier and reachable over HTTP. Oracle's advisory categorizes the affected component as 'All Miscellaneous EDI Issues,' and the vendor-supplied tag labels it as Information Disclosure, though the description explicitly states the outcome is full product takeover. No CWE was assigned in the source data, so the precise root-cause class (e.g., injection, deserialization, or authentication bypass) cannot be confirmed from the available intelligence.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (Patch available per vendor advisory) documented at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle does not publish a single standalone fix version for EDI Gateway, so administrators must map their EBS 12.2 patch level to the corresponding CPU July 2026 EBS patch bundle and apply it across the 12.2.3-12.2.15 range. Because the vulnerability is reachable over HTTP by unauthenticated attackers, until patching is complete restrict network access to the EBS application tier and the EDI Gateway endpoints so they are not exposed to the internet or untrusted networks - place them behind a VPN or restrict source IPs at the load balancer/reverse proxy, accepting that this may disrupt external trading-partner connectivity that legitimately relies on EDI transport. Additionally, monitor EBS web tier and EDI Gateway HTTP logs for anomalous requests. No independent fix version could be verified beyond the CPU bundle, so confirm the exact patch number for your release with Oracle Support.