What is the CVSS score of CVE-2026-60795?

CVE-2026-60795 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Oracle iSetup CVE-2026-60795

EUVD-2026-47110 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-mfrf-823j-w85h

Authentication Bypass Oracle Isetup

6.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.8 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.8 MEDIUM

Low-privileged network attacker via HTTP; AC:H matches Oracle's 'difficult to exploit' language; no availability impact per description.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:49 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSetup. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle iSetup accessible data as well as unauthorized access to critical data or complete access to all Oracle iSetup accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Oracle iSetup (versions 12.2.3 through 12.2.15), the General Ledger Update Transform and Reports component within Oracle E-Business Suite, allows a low-privileged authenticated attacker with network access via HTTP to bypass authorization controls and achieve complete confidentiality and integrity compromise of all iSetup-accessible data. Successful exploitation enables unauthorized read access to critical financial data and the ability to create, modify, or delete ledger records - a significant business risk in financial and compliance contexts despite the CVSS 3.1 medium score of 6.8. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle iSetup is a setup, migration, and reporting module within Oracle E-Business Suite (EBS), an enterprise-grade ERP platform widely deployed at large and mid-tier organizations. The affected component - General Ledger Update Transform and Reports - handles financial data transformation pipelines and reporting workflows accessible via Oracle EBS's HTTP-based web interface. The vulnerability is tagged as an 'Authentication Bypass,' pointing to a root cause class consistent with CWE-287 (Improper Authentication) or CWE-862 (Missing Authorization), though no formal CWE has been assigned by Oracle (listed as N/A). The CVSS vector (AV:N/AC:H/PR:L) indicates the flaw is reachable over the network via HTTP by a low-privileged account but requires high-complexity exploitation conditions - likely specific request crafting, timing, or parameter manipulation not publicly disclosed. Affected versions are confirmed as 12.2.3 through 12.2.15 per both the Oracle advisory and ENISA EUVD-2026-47110. No CPE strings were included in the available intelligence data.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU), referenced at https://www.oracle.com/security-alerts/cpujul2026.html. The CPU is Oracle's primary vehicle for this fix; the exact patched version identifier is not independently confirmed in the available data and must be verified via Oracle My Oracle Support (MOS) using the patch search for Oracle E-Business Suite 12.2.x. As a compensating control prior to patching, restrict network access to the Oracle iSetup HTTP interface to known trusted IP ranges using network-layer ACLs or the Oracle EBS firewall configuration - note this may impact remote EBS users and should be coordinated with the EBS administration team. Additionally, audit and minimize the set of accounts with low-privileged access to the General Ledger Update Transform and Reports component, and review recent iSetup activity logs for anomalous data access or modification patterns in ledger transform jobs. No workaround is confirmed by Oracle in the available data.