What is the CVSS score of CVE-2026-60843?

CVE-2026-60843 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Oracle Citizen Interaction Center CVE-2026-60843

EUVD-2026-47142 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-mxvp-wc8f-phh2

Authentication Bypass Oracle E Business Suite

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network HTTP access confirmed; PR:H because exploitation requires a high-privilege account; no availability impact per description; scope unchanged.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:44 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Citizen Interaction Center product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Citizen Interaction Center. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Citizen Interaction Center accessible data as well as unauthorized access to critical data or complete access to all Oracle Citizen Interaction Center accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Critical data exposure and tampering in Oracle Citizen Interaction Center (E-Business Suite component) versions 12.2.3 through 12.2.15 allows a high-privileged, network-authenticated attacker to achieve full read and write access to all application data via HTTP. Despite the 'Authentication Bypass' tag, the CVSS PR:H metric indicates exploitation requires an already-authenticated high-privilege account, suggesting an internal authorization control bypass rather than an unauthenticated entry point. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed through Oracle's Critical Patch Update for July 2026.

Technical ContextAI

Oracle Citizen Interaction Center is a specialized module within Oracle E-Business Suite (EBS), designed for government and public-sector organizations to manage citizen service workflows and case interactions. The affected component is 'Internal Operations,' which likely governs backend processing, data routing, or administrative functions within the module. The CWE is listed as N/A, preventing formal root-cause classification; however, the 'Authentication Bypass' tag suggests the flaw may reside in an authorization or access-control layer within an authenticated session - enabling a privileged user to bypass internal permission boundaries and access or modify data outside their sanctioned scope. No CPE strings were provided, but affected versions are definitively scoped to Oracle Citizen Interaction Center 12.2.3 through 12.2.15 within the Oracle EBS platform, per the EUVD entry EUVD-2026-47142.

RemediationAI

Apply Oracle's Critical Patch Update (CPU) for July 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. The CPU is Oracle's standard quarterly patch vehicle; the exact patched build version is not independently confirmed from the data provided, so administrators should consult My Oracle Support and the CPU release notes for the specific patch number targeting CVE-2026-60843. As a compensating control pending patching, restrict HTTP access to Oracle EBS Internal Operations endpoints to the minimum set of trusted administrator IP ranges using network-layer ACLs or WAF rules, noting this does not eliminate risk from compromised internal admin accounts. Audit and minimize the number of accounts holding high-privilege roles within Oracle Citizen Interaction Center, applying least-privilege principles to reduce the attacker-reachable population. Given the 'Authentication Bypass' tag discrepancy, monitor Oracle's advisory for clarification on whether the fix also addresses an unauthenticated attack path.