What is the CVSS score of CVE-2026-60827?

CVE-2026-60827 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle iSupport are affected by CVE-2026-60827?

Oracle iSupport within E-Business Suite versions 12.2.3-12.2.15 contains an integrity vulnerability allowing social engineering attacks to manipulate critical financial and operational data across…

How to fix or mitigate CVE-2026-60827?

Within 24 hours: Identify all Oracle E-Business Suite iSupport instances running versions 12.2.3 through 12.2.15 and classify by business criticality; implement email filtering with attachment blocking and URL inspection for all iSupport user accounts. Within 7 days: Deploy mandatory social engineering and threat awareness training to all iSupport users and Oracle EBS administrators; enforce principle-of-least-privilege access controls limiting iSupport functionality to essential roles; enable detailed audit logging at the database layer for all data-modification transactions in iSupport. Within 30 days: Implement real-time alerting for anomalous data changes within iSupport; subscribe to Oracle security bulletins and establish staging environment for testing patches to Oracle E-Business Suite; develop a prioritized patch deployment plan with target completion within 48 hours of patch availability.

Oracle iSupport CVE-2026-60827

EUVD-2026-47130 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-grq8-wmxc-fjjw

Authentication Bypass Oracle Isupport

7.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.4 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

vuln.today AI

7.4 HIGH

Remote HTTP reach with no auth but mandatory victim interaction (UI:R) and cross-module scope change; integrity-only impact, so C:N/A:N and I:H.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:55 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.4

DescriptionCVE.org

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iSupport, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle iSupport accessible data. CVSS 3.1 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).

AnalysisAI

Cross-context integrity compromise in Oracle iSupport (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a remote unauthenticated attacker to manipulate, create, or delete critical data after luring a victim into interacting with malicious content, with impact spilling into other Oracle EBS products due to a scope change. Addressed in Oracle's July 2026 Critical Patch Update, it carries a CVSS 3.1 base score of 7.4 with integrity-only impact and no public exploit identified at time of analysis. The requirement for victim interaction lowers the practical exploitation rate relative to a fully unauthenticated automated attack.

Technical ContextAI

Oracle iSupport is a web-based self-service customer support module within the Oracle E-Business Suite (EBS) applications platform, running on the Oracle Application Server/HTTP stack and backed by the EBS database schema. The CVSS profile - network vector, no privileges, required user interaction, scope change, and integrity-only impact (C:N/I:H/A:N) - is the classic signature of a stored or reflected cross-site scripting / content-injection style flaw where attacker-controlled input is rendered in a victim's authenticated session, letting the attacker act with that victim's authority across EBS modules. No CWE was assigned in the source data, but the metric shape aligns with CWE-79 (XSS) or a related output-neutralization/injection weakness; the 'Authentication Bypass' tag in the intelligence feed is not corroborated by the description and should be treated with caution.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (Patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html); Oracle does not publish a standalone semantic fix version, so identify the specific iSupport/EBS 12.2.x patch set for your deployment from the CPU matrix and apply it to reach a patched state. Until patched, reduce exposure by restricting network access to the iSupport web endpoints to trusted networks or via a WAF/reverse-proxy that filters injected script and malicious payloads (trade-off: may block legitimate external self-service users), and by disabling or tightly limiting the iSupport module if it is not in active use (trade-off: removes customer self-service functionality). Because exploitation requires tricking a user, reinforce phishing/social-engineering awareness for staff and customers who interact with iSupport as a secondary control.