What is the CVSS score of CVE-2026-60802?

CVE-2026-60802 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle E-Business Intelligence CVE-2026-60802

EUVD-2026-47114 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-4x95-5vr3-grgg

Authentication Bypass Oracle E Business Suite

6.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-delivered, no attacker privileges required, victim interaction mandatory, scope change consistent with browser-context injection; limited C/I impact, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:48 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle E-Business Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle E-Business Intelligence. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle E-Business Intelligence, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle E-Business Intelligence accessible data as well as unauthorized read access to a subset of Oracle E-Business Intelligence accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

AnalysisAI

Cross-site scripting or client-side injection in Oracle E-Business Intelligence 12.2.3 through 12.2.15 enables unauthenticated remote attackers to read a subset of accessible data and perform unauthorized data modifications when a victim user interacts with a crafted HTTP request. The scope change (S:C in CVSS) indicates successful exploitation extends impact beyond the vulnerable component - characteristic of a browser-context attack such as reflected XSS through the Internal Operations component. No public exploit code or CISA KEV listing has been identified at time of analysis, though the tagging as 'Authentication Bypass' alongside PR:N merits close attention in enterprise deployments.

Technical ContextAI

Oracle E-Business Intelligence is a reporting and analytics module within Oracle E-Business Suite (EBS), an enterprise resource planning platform widely deployed in large organizations. The affected component is 'Internal Operations,' exposed over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is the canonical fingerprint of a reflected cross-site scripting or similar client-side injection class: network-reachable, low-complexity, no attacker authentication, requires victim interaction, and produces a scope change affecting a secondary context such as the victim's browser. CWE was not assigned in the source data, preventing root-cause classification at the code level, but the CVSS profile strongly implies an output-encoding failure in a web-rendered response. Affected versions span 12.2.3 to 12.2.15 per Oracle and EUVD data.

RemediationAI

Apply the Oracle Critical Patch Update released July 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched version number is not specified in the available data - consult the Oracle CPU patch matrix to identify the correct patch for your EBS release within the 12.2.3-12.2.15 range. As a compensating control pending patching, restrict HTTP access to the Oracle E-Business Intelligence Internal Operations component to trusted internal networks or VPN-only connections via perimeter firewall rules - this limits the attacker's ability to deliver crafted links to external users, though it does not eliminate risk from insider-delivered phishing. Additionally, user-awareness training to avoid clicking unsolicited links into EBS sessions provides a behavioral mitigation given the UI:R requirement. Content Security Policy headers, if configurable in the EBS web tier, may reduce the blast radius of any injected script.