What is the CVSS score of CVE-2026-60775?

CVE-2026-60775 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Oracle Pasta CVE-2026-60775

EUVD-2026-47095 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-8767-2rcw-2rx3

Authentication Bypass Oracle E Business Suite

6.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.7 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.7 MEDIUM

Local attack vector with high privileges required for infrastructure logon; full CIA impact on Pasta confirms scope-unchanged complete component compromise.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:50 vuln.today

DescriptionCVE.org

Vulnerability in the Pasta product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Pasta executes to compromise Pasta. Successful attacks of this vulnerability can result in takeover of Pasta. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle E-Business Suite's Pasta component (Internal Operations) is achievable by a high-privileged attacker with local logon access to the host infrastructure running versions 12.2.3 through 12.2.15. Successful exploitation yields complete confidentiality, integrity, and availability compromise of the Pasta service, consistent with the tags noting Information Disclosure as a primary impact vector alongside full control. Patched in Oracle Critical Patch Update July 2026; no public exploit identified at time of analysis and the component is not listed in CISA KEV.

Technical ContextAI

The Pasta product is an Internal Operations component within Oracle E-Business Suite (EBS), Oracle's suite of integrated enterprise business applications. The CVSS vector AV:L specifies the attack is strictly local - the adversary must have an established interactive or batch logon session on the infrastructure host where Pasta executes, ruling out remote network exploitation. PR:H confirms the attacker must already hold high-level privileges on that system. S:U (scope unchanged) indicates the blast radius is confined to the Pasta component itself without crossing security boundaries into adjacent components. CWE is listed as N/A, meaning Oracle has not disclosed the specific weakness class; the root cause could range from insecure file handling to privilege misuse within the Internal Operations subsystem. Affected versions span 12.2.3 through 12.2.15 per both Oracle and EUVD-2026-47095.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. An exact fixed version number beyond the CPU release itself was not independently confirmed in the available data - consult the Oracle My Oracle Support portal for the specific patch ID applicable to your EBS version. As a compensating control prior to patching, restrict local logon access to EBS infrastructure hosts running the Pasta component to only the minimum set of operationally required privileged accounts; removing unnecessary OS-level admin grants reduces the exploitable account population without affecting application functionality. Additionally, implement host-based audit logging for privileged sessions on Pasta infrastructure nodes to detect anomalous activity. Note that restricting local logon may impact legitimate administrative workflows and should be coordinated with EBS operations teams.