What is the CVSS score of CVE-2026-60825?

CVE-2026-60825 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Oracle iSupport CVE-2026-60825

EUVD-2026-47128 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-fxwc-92hx-jfj6

Authentication Bypass Oracle Isupport

6.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.6 MEDIUM

HTTP network vector confirmed; PR:H and AC:H reflect admin-only access and unspecified environmental prerequisites; full C/I/A impact aligns with stated system takeover.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:46 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks of this vulnerability can result in takeover of Oracle iSupport. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle iSupport (E-Business Suite versions 12.2.3-12.2.15) is achievable by a highly privileged remote attacker exploiting a flaw in the Internal Operations component via HTTP, resulting in complete compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score of 6.6 reflects the severity of the impact offset by high attack complexity and high privilege requirements, which meaningfully constrain the exploitable attacker population. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, making this a significant but operationally constrained risk for Oracle EBS deployments.

Technical ContextAI

Oracle iSupport is a self-service customer support portal module embedded within Oracle E-Business Suite (EBS), a large-scale enterprise resource planning platform used primarily by large organizations in finance, manufacturing, and public sector. The vulnerability affects the Internal Operations component, reachable over HTTP at the network layer. No CWE identifier has been assigned, leaving the precise root cause class unspecified in available data; however, the combination of the 'Information Disclosure' tag and a full-takeover impact (C:H/I:H/A:H) suggests an access control, privilege escalation, or server-side logic flaw within the internal processing layer of iSupport. Affected versions span 12.2.3 through 12.2.15 as documented in Oracle's July 2026 Critical Patch Update.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, which addresses this vulnerability per the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched release version is not independently confirmed in the available data beyond the CPU reference - consult Oracle My Support for the specific patch identifier applicable to your EBS version. As a compensating control prior to patching, restrict HTTP access to the Oracle iSupport Internal Operations component at the network layer to only trusted administrative source IPs, reducing exposure to the minimum necessary privileged user set. Additionally, audit and reduce the number of accounts holding high-privilege roles within Oracle iSupport, as exploitation requires PR:H credentials - shrinking the privilege footprint directly limits the attacker pool. Monitor privileged account activity against iSupport Internal Operations endpoints for anomalous access patterns.