What is the CVSS score of CVE-2026-60810?

CVE-2026-60810 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60810?

Oracle E-Business Suite versions 12.2.3 through 12.2.15 contain an unauthenticated remote access vulnerability in the Supply Chain Trading Connector that allows attackers to read sensitive supply…

How to fix or mitigate CVE-2026-60810?

Within 24 hours: Identify all EBS systems running versions 12.2.3 through 12.2.15, audit access logs for the Collaboration History component, and implement firewall rules to restrict network access to this component to internal systems only. Within 7 days: Deploy enhanced logging and monitoring for the Supply Chain Trading Connector, restrict database credentials with access to this component, and establish incident response procedures. Within 30 days: Coordinate with Oracle for patch availability through your support contract, prepare a pre-validated update plan for immediate deployment when patches are released, and conduct a supply chain impact assessment for any unauthorized access that may have occurred.

Oracle E-Business Suite CVE-2026-60810

EUVD-2026-47119 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-xw84-49hh-wvfv

Authentication Bypass Oracle E Business Suite

8.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Unauthenticated remote HTTP access with low complexity gives AV:N/AC:L/PR:N/UI:N; high data disclosure (C:H), limited modification (I:L), and no availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:05 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.2

DescriptionCVE.org

Vulnerability in the Oracle Supply Chain Trading Connector product of Oracle E-Business Suite (component: Collaboration History). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Supply Chain Trading Connector. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Supply Chain Trading Connector accessible data as well as unauthorized update, insert or delete access to some of Oracle Supply Chain Trading Connector accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

AnalysisAI

Unauthenticated data compromise in Oracle Supply Chain Trading Connector (Collaboration History component) of Oracle E-Business Suite 12.2.3 through 12.2.15 allows remote attackers to read all data accessible to the product over HTTP and make limited unauthorized modifications. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 8.2, the flaw is tagged as an authentication bypass and requires no privileges or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network exposure make it a strong patching priority for EBS operators.

Technical ContextAI

The affected technology is Oracle E-Business Suite (EBS), a large web-based ERP application suite, specifically the Supply Chain Trading Connector (part of the iSupplier/B2B collaboration stack) and its Collaboration History component, which records trading-partner exchange data. The CWE is not assigned in the input, but the 'Authentication Bypass' tag combined with the CVSS PR:N metric points to a broken/missing authentication root cause (CWE-287/CWE-306 class) where an HTTP-facing endpoint can be reached without valid session credentials. EBS exposes these modules through the Oracle Application Server / WebLogic HTTP front end, so any internet- or intranet-reachable EBS deployment presents the vulnerable endpoint. No CPE strings were supplied; affected product identity is derived from the Oracle description and ENISA EUVD entry EUVD-2026-47119.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships EBS security fixes as cumulative CPU patches for the 12.2 release line rather than a single renamed version, so apply the July 2026 CPU patch level appropriate to your 12.2.x installation - no standalone fixed version string was provided in the input, so consult the CPU patch matrix for your exact release. As compensating controls until patching, restrict network access to the Supply Chain Trading Connector / iSupplier and Collaboration History URLs so they are not reachable from untrusted or internet-facing networks (via reverse-proxy URL firewall / Oracle URL firewall rules), and place EBS behind a VPN or IP allowlist for external trading partners; the trade-off is that legitimate external B2B partners may lose direct connectivity and require whitelisting. If the Supply Chain Trading Connector module is not in use, disable or block its endpoints entirely. Monitor EBS access logs for anonymous HTTP requests to the affected servlets.