What is the CVSS score of CVE-2026-60847?

CVE-2026-60847 has a CVSS 3.1 base score of 3.4 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Oracle Order Entry CVE-2026-60847

EUVD-2026-47146 LOW

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-pfgw-qfgp-xpv8

Oracle Denial Of Service Privilege Escalation E Business Suite

3.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.4 LOW

AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

3.4 LOW

Local attack requiring high privileges on host infrastructure; only low integrity and availability impact, no confidentiality exposure, unchanged scope.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:43 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Order Entry product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Order Entry executes to compromise Oracle Order Entry. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Order Entry accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Order Entry. CVSS 3.1 Base Score 3.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L).

AnalysisAI

Oracle Order Entry in E-Business Suite versions 12.2.3 through 12.2.15 exposes a low-severity local privilege vulnerability in its Internal Operations component, allowing a high-privileged local attacker to perform unauthorized data manipulation and cause partial service disruption. The attack requires physical or logical access to the infrastructure hosting the application and an already-elevated account, significantly constraining real-world exploitability. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at the time of analysis.

Technical ContextAI

Oracle Order Entry is a transactional module within Oracle E-Business Suite (EBS), managing the full lifecycle of customer sales orders. The vulnerability resides specifically in the Internal Operations component of Order Entry, which handles back-end processing logic on the host infrastructure. The CVSS vector (AV:L) confirms the attack surface is local - the attacker must have logon access to the server or virtual machine where EBS executes, not merely network access to the application tier. No CWE identifier was provided by Oracle or NVD, preventing precise root-cause classification; however, the impact profile (unauthorized insert/update/delete and partial DoS) suggests a privilege boundary or access control weakness within the component's internal processing routines. Affected CPE targets Oracle E-Business Suite Order Entry versions 12.2.3 through 12.2.15.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability. Oracle has not published a specific patched build version number in the available intelligence data beyond the CPU advisory reference; confirm the exact patch bundle with Oracle support. As a compensating control, restrict local logon access to E-Business Suite infrastructure to the minimum necessary set of OS-level accounts and enforce least-privilege principles for administrative roles within Oracle EBS. Audit and review accounts with high-privilege access to the Order Entry Internal Operations component. Because the attack requires local infrastructure access, strong host access controls (PAM, bastion hosts, privileged access workstations) reduce risk even before patching, with no meaningful functional trade-off for normal application users.