What is the CVSS score of CVE-2026-60774?

CVE-2026-60774 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60774?

A high-severity vulnerability in Oracle E-Business Suite (versions 12.2.3-12.2.15) allows authenticated users with minimal privileges to access sensitive business data through the Oracle Applications…

How to fix or mitigate CVE-2026-60774?

Within 24 hours, identify and document all Oracle E-Business Suite instances running versions 12.2.3-12.2.15 in your environment and verify whether the Search Bean component in the OAF layer is accessible to standard user accounts. Within 7 days, apply the Oracle July 2026 Critical Patch Update to all affected systems to address CVE-2026-60774. Within 30 days, complete patching across all instances, conduct a security review of audit logs for any unauthorized OAF data access attempts during the vulnerability window, and validate that proper access controls restrict sensitive data access to authorized roles only.

Oracle E-Business Suite CVE-2026-60774

EUVD-2026-47094 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-3h92-24v4-85mc

Authentication Bypass Oracle Applications Framework

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Network HTTP access with a low-privileged account and no user interaction (AV:N/AC:L/PR:L/UI:N); broad data read gives C:H, limited record modification gives I:L, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:36 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Search Bean [Incl. Advanced]). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications Framework accessible data as well as unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).

AnalysisAI

Unauthorized data access in Oracle Applications Framework (the OAF layer of Oracle E-Business Suite) lets a low-privileged, network-based attacker abuse the Search Bean [Incl. Advanced] component to read all OAF-accessible data and perform limited unauthorized updates, inserts, or deletes. Affected releases span EBS 12.2.3 through 12.2.15, and the flaw is rated CVSS 3.1 7.1 with high confidentiality and low integrity impact. No public exploit has been identified at time of analysis, and it is addressed in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Applications Framework (OAF) is the Java/MVC presentation and business-logic layer that renders the self-service web UI for Oracle E-Business Suite. The vulnerable component is the Search Bean (including its Advanced search capability), a reusable UI region that constructs and executes queries against EBS application data. A weakness in how this bean scopes or authorizes queries allows an authenticated user with only low privileges to retrieve data beyond their authorization boundary and to mutate a subset of records. No CWE was assigned by NVD; the vendor tag 'Authentication Bypass' plus the observed impact (broad read of OAF-accessible data across authorization boundaries) is most consistent with an access-control / authorization flaw (CWE-284/CWE-863 class) rather than memory corruption.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle CPU fixes are cumulative and delivered as EBS patch bundles, so apply the CPU-recommended patch for your 12.2.x level rather than an isolated version bump - an exact standalone fix version is not stated in the provided data, so consult the CPU patch matrix for your release. Because Oracle CPU patches require downtime and regression testing, plan a maintenance window and validate in a test instance first. Until patched, compensating controls include tightening OAF function/role grants to minimize which users can reach Search Bean-backed pages, restricting network access to the EBS self-service tier by placing the OA_HTML endpoints behind a WAF/reverse proxy and VPN to remove external exposure, and increasing auditing of anomalous search and data-access patterns; note these controls reduce but do not eliminate risk since any legitimate low-privileged user remains a potential exploiter and role-tightening may disrupt users who legitimately need search functionality.