What is the CVSS score of CVE-2026-60801?

CVE-2026-60801 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

E-Business Intelligence CVE-2026-60801

EUVD-2026-47113 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-w597-fgv7-xfmm

Oracle Authentication Bypass E Business Suite

5.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

5.9 MEDIUM

Network HTTP access required with high complexity and high privileges; no availability impact stated; confidentiality and integrity both fully compromised within the application scope.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:49 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle E-Business Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle E-Business Intelligence. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle E-Business Intelligence accessible data as well as unauthorized access to critical data or complete access to all Oracle E-Business Intelligence accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Oracle E-Business Intelligence versions 12.2.3 through 12.2.15 contains a flaw in its Internal Operations component that, under high-complexity conditions, permits a network-accessible highly privileged attacker to gain unauthorized read and write access to critical business intelligence data. Despite high confidentiality and integrity impact metrics, the overall CVSS 3.1 score of 5.9 reflects the mitigating effects of AC:H and PR:H, meaning exploitation is neither trivial nor broadly accessible. Notably, the 'Authentication Bypass' tag attached to this vulnerability is in tension with the PR:H CVSS metric, suggesting the bypass may circumvent a secondary authorization layer rather than the initial authentication mechanism - no public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Oracle E-Business Intelligence is the reporting and analytics module of Oracle E-Business Suite (EBS), a widely deployed enterprise resource planning platform. The affected component, Internal Operations, is an administrative or back-end service layer exposed over HTTP within the EBS application stack. The affected CPE range spans Oracle EBS releases 12.2.3 through 12.2.15. No CWE was formally assigned (listed as N/A), which limits root-cause categorization; however, the 'Authentication Bypass' tag suggests a flaw in access-control enforcement within the Internal Operations component, potentially involving session validation, privilege escalation logic, or an improper authorization check that can be satisfied under specific high-complexity conditions. The CVSS vector's S:U (scope unchanged) indicates the impact is contained within the EBS application boundary.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability per Oracle's security advisory. No specific patched version number beyond the CPU release was provided in the source data, so the exact fix version has not been independently confirmed - consult the CPU advisory directly to identify the applicable patch for your EBS release within the 12.2.3-12.2.15 range. As compensating controls pending patch application, restrict network access to the Internal Operations component at the application and network layer to limit exposure to only trusted, high-privileged administrative accounts; this aligns with the AV:N/PR:H attack vector and reduces the viable attacker population. Additionally, audit and reduce the number of accounts holding high-privileged access to Oracle EBS to minimize the blast radius of any compromised credential. Note that network-layer restrictions may affect administrative workflows that legitimately depend on remote access to Internal Operations.