What is the CVSS score of CVE-2026-60812?

CVE-2026-60812 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Supply Chain Connector CVE-2026-60812

EUVD-2026-47121 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-mhv7-pm7q-r4wr

Authentication Bypass Information Disclosure Oracle E Business Suite

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network HTTP access with low credential required; no integrity or availability impact; confidentiality fully compromised within connector scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:47 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Supply Chain Trading Connector product of Oracle E-Business Suite (component: Collaboration History). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Supply Chain Trading Connector. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Supply Chain Trading Connector accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Supply Chain Trading Connector (E-Business Suite versions 12.2.3 through 12.2.15) exposes all connector-accessible data to low-privileged authenticated network attackers via HTTP. The Collaboration History component fails to enforce proper authorization controls, enabling a valid but low-privileged account to read critical trading data beyond its intended scope. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and straightforward network vector make this a realistic insider or credential-compromise escalation path.

Technical ContextAI

Oracle Supply Chain Trading Connector is a sub-module of Oracle E-Business Suite (EBS), providing integration between supply chain partners for collaboration and order/shipment history. The vulnerable component is Collaboration History, accessible via HTTP, suggesting a web-based UI or API endpoint within the EBS stack. The CVSS vector (AV:N/AC:L/PR:L/UI:N) identifies this as a network-reachable, low-complexity authorization flaw requiring only a low-privileged EBS account. No CWE identifier was assigned by Oracle or NVD, but the 'Authentication Bypass' tag in the intelligence data most likely denotes an authorization bypass (improper access control) rather than a complete authentication circumvention, given PR:L in the vector confirms a session credential is required. Affected CPE scope covers EBS versions 12.2.3 through 12.2.15.

RemediationAI

Apply the Oracle Critical Patch Update released July 2026, which addresses this vulnerability for Oracle E-Business Suite 12.2.3 through 12.2.15; consult the advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch set applicable to your release. Oracle does not publish individual fix version numbers separate from CPU bundles, so the patch is delivered as part of the cumulative CPU rather than a standalone upgrade. If immediate patching is not feasible, compensating controls should include restricting network access to the EBS Collaboration History component to trusted internal IP ranges only, auditing and minimizing the number of accounts holding any EBS privilege level (particularly third-party/partner accounts), and enabling enhanced audit logging on the Collaboration History component to detect anomalous data access. Restricting HTTP access to the affected endpoint at the network layer reduces the attack surface but does not eliminate the vulnerability for users who legitimately require access.