What is the CVSS score of CVE-2026-60804?

CVE-2026-60804 has a CVSS 3.1 base score of 2.0 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle E-Business Intelligence CVE-2026-60804

EUVD-2026-47115 LOW

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-5q38-6mqf-xcq5

Oracle Authentication Bypass E Business Suite

2.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

2.0 LOW

AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

2.0 LOW

Consistent with description: network-reachable but requires high privileges, high complexity, victim interaction, and delivers only limited integrity impact.

3.1 AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:48 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle E-Business Intelligence product of Oracle E-Business Suite (component: Definition). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle E-Business Intelligence. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle E-Business Intelligence accessible data. CVSS 3.1 Base Score 2.0 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N).

AnalysisAI

Integrity compromise in Oracle E-Business Intelligence (component: Definition) affects versions 12.2.3 through 12.2.15, disclosed as part of Oracle's Critical Patch Update July 2026. A network-accessible, high-privileged attacker who can also induce victim interaction may perform unauthorized insert, update, or delete operations on a subset of accessible E-Business Intelligence data. The CVSS base score of 2.0 reflects the highly constrained exploitation requirements: high attack complexity, high privilege level, and mandatory user interaction, all of which drastically limit real-world exploitation probability. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

Oracle E-Business Intelligence is the analytics and reporting layer of Oracle E-Business Suite (EBS), providing business intelligence capabilities via web-based HTTP interfaces. The vulnerability resides in the 'Definition' sub-component, which likely governs report or query definition metadata. The affected version range - 12.2.3 through 12.2.15 - covers a broad span of the EBS 12.2 release train, a long-running branch widely deployed in enterprise ERP environments. No CWE was assigned by the reporter; however, the tag 'Authentication Bypass' suggests a logic or authorization control flaw within the Definition component, where an already-authenticated high-privileged user may be able to perform data manipulation operations beyond their intended authorization boundary, contingent on user interaction from another party. The HTTP attack vector confirms the vulnerable interface is web-exposed.

RemediationAI

Apply the patches released in the Oracle Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPU advisories include cumulative patch bundles for E-Business Suite 12.2.x; administrators should consult the advisory to identify the specific patch applicable to their installed version within the 12.2.3-12.2.15 range. An exact patched version number was not independently confirmed from the provided references - verify the precise fix bundle via the Oracle support portal or the CPU advisory page. As a compensating control where immediate patching is not feasible, restricting HTTP access to the E-Business Intelligence Definition component to only authorized high-privileged administrators via network ACLs or application-layer access controls would reduce the already-narrow attack surface. Given the UI:R requirement, no additional social-engineering mitigations are necessary beyond standard user awareness of phishing-style requests to perform actions in EBS.