What is the CVSS score of CVE-2026-60823?

CVE-2026-60823 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle iSupport are affected by CVE-2026-60823?

Oracle iSupport component in E-Business Suite versions 12.2.3-12.2.15 exposes a high-severity vulnerability allowing unauthenticated attackers to read and modify all iSupport-accessible business…

How to fix or mitigate CVE-2026-60823?

Within 24 hours: identify all Oracle E-Business Suite 12.2.x systems running versions 12.2.3 through 12.2.15 and immediately implement network firewall rules to restrict HTTP and HTTPS access to iSupport components from trusted administrative networks only. Within 7 days: contact Oracle support to determine upgrade feasibility to version 12.2.16 or later; perform a 30-day retrospective audit of iSupport access logs to detect unauthorized data access or modification; document findings and escalate to senior leadership. Within 30 days: execute either a complete upgrade to a patched version or implement sustained compensating controls validated by Oracle; retest network restrictions and access controls; establish monthly monitoring of iSupport access logs and quarterly security reviews.

Oracle iSupport CVE-2026-60823

EUVD-2026-47126 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-3cc5-g33j-226j

Authentication Bypass Oracle Isupport

7.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

Reachable over HTTP without credentials (AV:N/PR:N/UI:N) but Oracle-rated difficult to exploit (AC:H); full read/write to iSupport data gives C:H/I:H, no availability impact so A:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:57 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.4

DescriptionCVE.org

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle iSupport accessible data as well as unauthorized access to critical data or complete access to all Oracle iSupport accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle iSupport (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a remote unauthenticated attacker to reach the application over HTTP and gain read and write access to all iSupport-accessible data. The flaw carries a CVSS 3.1 base score of 7.4 with high confidentiality and integrity impact but no availability impact, and Oracle rates it difficult to exploit (AC:H). No public exploit has been identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was supplied.

Technical ContextAI

Oracle iSupport is the web-based customer self-service and support portal module of Oracle E-Business Suite (EBS), Oracle's on-premises enterprise ERP suite; the affected component is 'Internal Operations'. Because the vector is AV:N over HTTP with PR:N, the vulnerable code path is reachable through the internet-facing/HTTP tier of EBS without a session, consistent with the 'Authentication Bypass' tag supplied in the intelligence. No CWE was assigned by NVD/Oracle, so the precise root-cause class (e.g., broken authentication or access control) cannot be stated with certainty; the combined C:H/I:H, A:N profile indicates an attacker can read and alter iSupport data but cannot degrade availability, pointing to an authorization/authentication logic defect rather than memory corruption or a denial-of-service bug.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (Patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html); Oracle does not publish a separate point-release version for individual EBS CVEs, so the CPU patch level for EBS 12.2 is the fix - no independent standalone fix version was provided in the input, so verify the exact CPU patch number against your EBS 12.2.x baseline in My Oracle Support. Until the CPU is applied, reduce exposure by restricting network access to the iSupport/Internal Operations endpoints, placing the EBS HTTP tier behind a VPN or reverse proxy with IP allow-listing, and using EBS URL Firewall / DMZ URL-restriction configuration to block untrusted external access to iSupport modules (trade-off: this can break legitimate external customer self-service access, so scope allow-lists carefully). Monitor iSupport HTTP logs for anomalous unauthenticated requests to Internal Operations paths as a detective control.