What is the CVSS score of CVE-2026-60826?

CVE-2026-60826 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Oracle iSupport CVE-2026-60826

EUVD-2026-47129 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-4gff-g5qg-73wc

Authentication Bypass Oracle Isupport

6.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.6 MEDIUM

Network HTTP vector confirmed by description; PR:H and AC:H are consistent with Oracle's 'difficult to exploit, high privileged attacker' characterization; unchanged scope and full CIA impact align with 'takeover' outcome.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:45 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks of this vulnerability can result in takeover of Oracle iSupport. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Oracle iSupport versions 12.2.3 through 12.2.15 within Oracle E-Business Suite contain a vulnerability in the Internal Operations component that allows a highly privileged network attacker to fully compromise the affected application via HTTP. Successful exploitation results in complete confidentiality, integrity, and availability impact - described by Oracle as a full takeover of Oracle iSupport. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; disclosure occurred through Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle iSupport is a customer self-service web application within the Oracle E-Business Suite (EBS) platform, enabling customers to manage service requests, billing, and account operations through an HTTP-based interface. The affected component is identified as 'Internal Operations,' though the specific root cause class (CWE) is listed as N/A - a deliberate omission consistent with Oracle's standard CPU disclosure practices. The CVSS vector (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates the flaw is reachable over the network via HTTP but requires both high privileges and high attack complexity, suggesting the exploit path may involve race conditions, specific application state dependencies, or a multi-step sequence that is difficult to reliably reproduce. Affected versions span 12.2.3 through 12.2.15, confirmed by both the Oracle CPU advisory and the ENISA EUVD-2026-47129 record.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update, which addresses this vulnerability per the advisory at https://www.oracle.com/security-alerts/cpujul2026.html - the exact patched iSupport version number is not independently confirmed in the available data, so organizations should consult the Oracle CPU patch matrix for the specific patch identifier applicable to their release. As a compensating control prior to patching, restrict network access to the iSupport Internal Operations component to known administrative IP ranges only, reducing exposure to external or lateral-movement attackers. Given the PR:H requirement, auditing and reducing the number of accounts with high privileges on Oracle EBS directly limits the population of potential exploiters - accounts that do not require Internal Operations access should have that access revoked. Enabling Oracle EBS audit logging for Internal Operations activity provides detection telemetry while the patch is being applied. Note: restricting network access may impact legitimate administrative workflows and should be coordinated with EBS administrators.