What is the CVSS score of CVE-2026-60762?

CVE-2026-60762 has a CVSS 3.1 base score of 5.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Oracle E-Business Suite CVE-2026-60762

EUVD-2026-47086 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-4h3r-5365-xhcf

Authentication Bypass Oracle Applications Technology Stack

5.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.7 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

5.7 MEDIUM

Local attack vector and high privilege requirement confirmed by description; AC:H per vendor 'difficult to exploit'; no availability impact stated.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:51 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

MEDIUM 5.7

DescriptionCVE.org

Vulnerability in the Oracle Applications Technology Stack product of Oracle E-Business Suite (component: Configuration). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Applications Technology Stack executes to compromise Oracle Applications Technology Stack. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Applications Technology Stack accessible data as well as unauthorized access to critical data or complete access to all Oracle Applications Technology Stack accessible data. CVSS 3.1 Base Score 5.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Local privilege abuse in Oracle E-Business Suite's Applications Technology Stack Configuration component exposes critical data to high-privileged local attackers across versions 12.2.3 through 12.2.15. The vulnerability allows an authenticated, high-privileged attacker with local infrastructure access to achieve both full confidentiality and integrity compromise of all data accessible to the Applications Technology Stack, including unauthorized creation, deletion, and modification of critical records. No public exploit has been identified at time of analysis, and the vulnerability is tagged as an authentication bypass despite the PR:H requirement - suggesting the bypass may escalate effective access beyond what the initial privilege level should permit.

Technical ContextAI

Oracle E-Business Suite (EBS) is a comprehensive enterprise resource planning platform. The affected component is the Applications Technology Stack's Configuration subsystem, which governs foundational settings, environment parameters, and likely system-level or middleware configuration files underlying the EBS deployment. The CVSS vector AV:L indicates the attack surface is limited to the host where EBS executes, meaning the attacker must have an OS-level or infrastructure-level session on the application server. The CWE is not specified by the vendor, but the 'Authentication Bypass' tag suggests the Configuration component may improperly enforce authorization checks when accessed by a high-privileged local account, allowing that account to exceed its intended access boundary. Affected CPE covers Oracle Applications Technology Stack versions 12.2.3 through 12.2.15 running within Oracle E-Business Suite deployments.

RemediationAI

Organizations should apply the patches released by Oracle as part of the July 2026 Critical Patch Update (CPU), available at https://www.oracle.com/security-alerts/cpujul2026.html. No exact patched version number beyond the CPU release itself was identified in the available data - consult the Oracle My Oracle Support portal for the applicable patch ID for your specific EBS release within the 12.2.3-12.2.15 range. As a compensating control pending patch application, restrict local logon access to the EBS infrastructure host to the minimum required set of administrative accounts, enforcing separation of duties between OS-level admins and EBS application admins where possible. Audit and review local accounts with access to EBS configuration directories and files, and enable OS-level audit logging for file system changes to the Configuration component paths to detect unauthorized modifications. Note that restricting local access may impact legitimate administrative workflows and should be tested before broad enforcement.