What is the CVSS score of CVE-2026-60824?

CVE-2026-60824 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle iSupport are affected by CVE-2026-60824?

Oracle iSupport (E-Business Suite versions 12.2.3-12.2.15) contains an authentication bypass vulnerability permitting low-privileged network-adjacent attackers to exfiltrate sensitive data; the flaw…

How to fix or mitigate CVE-2026-60824?

Within 24 hours, identify and inventory all systems running Oracle iSupport versions 12.2.3-12.2.15, map their network connectivity and data access scope, and assess current security posture. Within 7 days, implement network segmentation to isolate affected iSupport systems, disable or restrict HTTP access in favor of encrypted protocols, deploy monitoring to detect suspicious data exfiltration patterns, and apply principle of least privilege to iSupport user accounts. Within 30 days, establish a process to track Oracle security advisories for patches targeting versions 12.2.16 and later, perform pre-production testing of any released patches, and schedule remediation deployment within your change management process.

Oracle iSupport CVE-2026-60824

EUVD-2026-47127 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-7hcv-4p5p-fh34

Authentication Bypass Oracle Isupport

7.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network HTTP portal (AV:N), easily exploitable (AC:L), requires a low-privilege account (PR:L), scope change to adjacent products (S:C), confidentiality-only high impact (C:H, I/A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:56 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.7

DescriptionCVE.org

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSupport. While the vulnerability is in Oracle iSupport, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iSupport accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Sensitive data exposure in Oracle iSupport (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-adjacent attacker to obtain unauthorized access to all iSupport-accessible data over HTTP. Because the flaw carries a scope change, successful exploitation may also significantly impact other products beyond iSupport itself, though only confidentiality is affected (no integrity or availability impact). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor tags it as an authentication-bypass class issue.

Technical ContextAI

Oracle iSupport is a self-service web support portal delivered as a module of Oracle E-Business Suite (EBS), a large integrated ERP/CRM platform typically deployed by enterprises for finance, procurement, and customer support. The affected component is 'Internal Operations,' and the vendor supplies the fix through the Oracle Critical Patch Update (CPU) of July 2026. No CWE was assigned in the source data, but the vendor tag 'Authentication Bypass' points to a broken access-control / improper authorization root cause (CWE-284/CWE-863 class) in which an authenticated low-privilege user can reach data or functions that should require higher privileges. The CVSS scope change (S:C) indicates the vulnerable iSupport component can act on resources managed by a different security authority within the EBS stack, which is why Oracle warns attacks 'may significantly impact additional products.' No CPE strings were provided; affected products are identified from the EUVD version range and Oracle advisory text.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html); the CPU is the primary and vendor-supported remediation for all affected 12.2.3-12.2.15 EBS iSupport deployments, and Oracle strongly recommends applying CPUs without delay. No standalone fixed build number was published in the source data beyond the CPU reference, so consult the CPU patch matrix for the exact EBS 12.2 patch level. As compensating controls until patching, restrict network access to the iSupport portal by placing it behind a VPN or IP allowlist and removing unnecessary internet exposure (trade-off: breaks external customer self-service), tighten iSupport account provisioning to disable or gate self-registration so low-privilege accounts cannot be freely obtained (trade-off: adds onboarding friction), and increase monitoring/WAF logging on iSupport HTTP endpoints for anomalous data-access patterns (trade-off: detective only, not preventive). Because the scope change can reach adjacent EBS products, verify segmentation and least-privilege between the iSupport module and other EBS components.