What is the CVSS score of CVE-2026-60760?

CVE-2026-60760 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Enterprise Asset Management CVE-2026-60760

EUVD-2026-47084 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-jrj5-7x42-8374

Authentication Bypass Oracle Enterprise Asset Management

4.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

4.2 MEDIUM

Network-delivered over HTTP with PR:L matching Oracle's 'low privileged attacker' description; AC:H reflects Oracle's explicit 'difficult to exploit' characterization; no availability impact confirmed.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:51 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Asset Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Asset Management accessible data as well as unauthorized read access to a subset of Oracle Enterprise Asset Management accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Oracle Enterprise Asset Management (EAM), a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, exposes an authentication bypass condition in the Internal Operations component that allows a low-privileged, network-authenticated attacker to read and tamper with a subset of EAM data. Despite the medium CVSS score of 4.2, the 'Authentication Bypass' tag signals that a legitimately low-privileged account can cross authorization boundaries within the application. No public exploit code exists and this vulnerability is not listed in CISA KEV, making it a moderate but non-urgent priority for most organizations.

Technical ContextAI

Oracle E-Business Suite (EBS) is a large, modular enterprise resource planning platform. The affected module, Enterprise Asset Management (EAM), handles the full lifecycle of physical assets including work orders, maintenance schedules, and operational data. The vulnerable component, 'Internal Operations,' is an HTTP-accessible backend layer, indicating the attack surface is an authenticated API or form endpoint rather than a client-side interface. The 'Authentication Bypass' tag, combined with the CVSS PR:L metric, suggests the bypass is not a complete authentication failure but rather an authorization control deficiency - a low-privileged session token can be leveraged to perform operations or access data scoped to higher-privilege roles. No CWE classification is provided by NVD, which limits root-cause specificity; the bypass could involve parameter manipulation, insecure direct object references, or session privilege mishandling. Affected CPE is implicitly Oracle EBS 12.2.3-12.2.15 per the EUVD entry.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, referenced at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability. An exact patched version number is not independently confirmed from available data beyond the CPU bulletin - consult Oracle's CPU patch availability matrix and My Oracle Support for the specific patch ID and release artifact. As a compensating control prior to patching, restrict access to the EAM Internal Operations component at the network level by limiting HTTP access to trusted internal IP ranges and enforcing role-based access control audits to ensure low-privilege accounts are not granted elevated EAM roles. Note that network restriction reduces exposure but does not eliminate the vulnerability since legitimate low-privileged users inside the network perimeter still represent a viable attack path given the AC:H requirement is attacker-controlled.