What is the CVSS score of CVE-2026-60811?

CVE-2026-60811 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Oracle Supply Chain Trading Connector CVE-2026-60811

EUVD-2026-47120 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-pqhm-q7mh-jv9w

Authentication Bypass Denial Of Service Oracle E Business Suite

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Network-accessible HTTP component requiring valid low-privileged credentials; partial confidentiality, integrity, and availability impacts with no scope change confirm C:L/I:L/A:L and S:U.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:47 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Supply Chain Trading Connector product of Oracle E-Business Suite (component: Collaboration History). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Supply Chain Trading Connector. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Supply Chain Trading Connector accessible data as well as unauthorized read access to a subset of Oracle Supply Chain Trading Connector accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Supply Chain Trading Connector. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Oracle Supply Chain Trading Connector versions 12.2.3 through 12.2.15 expose the Collaboration History component to unauthorized data access and service degradation by any authenticated network user over HTTP. Low-privileged attackers can read a subset of accessible records and perform unauthorized inserts, updates, and deletes, as well as cause a partial denial of service. No public exploit code and no CISA KEV listing exist at time of analysis, but Oracle's own advisory classifies this as 'Easily exploitable,' indicating minimal preconditions beyond valid credentials.

Technical ContextAI

Oracle Supply Chain Trading Connector is a module within Oracle E-Business Suite that manages collaboration workflows and interaction records between trading partners in supply chain operations. The vulnerable component, Collaboration History, processes HTTP-based requests related to these partner interaction records. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L indicates a network-reachable, low-complexity flaw accessible to any authenticated user without elevated privileges. The CWE classification was not assigned in the available data, preventing precise root-cause categorization, though the combined confidentiality, integrity, and availability impact profile is consistent with an improper authorization or access control deficiency within the Collaboration History subcomponent. Affected versions span the 12.2.3 to 12.2.15 release range of E-Business Suite.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched version number is not disclosed in the available intelligence data - consult the CPU advisory directly for the applicable patch identifier and installation instructions specific to the E-Business Suite release in use. As a compensating control while patching, restrict HTTP access to the Oracle E-Business Suite Collaboration History component at the network layer using firewall rules or a reverse proxy, limiting access to known, trusted IP ranges or requiring VPN connectivity. Additionally, audit and reduce the number of low-privileged accounts with access to the Supply Chain Trading Connector module. These controls reduce exposure surface but do not remediate the underlying vulnerability and should be treated as temporary measures only.