What is the CVSS score of CVE-2026-60864?

CVE-2026-60864 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Order Management CVE-2026-60864

EUVD-2026-47155 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-42wv-rmj2-jcq4

Information Disclosure Oracle Order Management

6.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.4 MEDIUM

Low-privilege authentication required over HTTP; scope change reflects EBS module interdependency; no availability impact; limited confidentiality and integrity impact only.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:43 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

MEDIUM 6.4

DescriptionCVE.org

Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management. While the vulnerability is in Oracle Order Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Order Management accessible data as well as unauthorized read access to a subset of Oracle Order Management accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).

AnalysisAI

Oracle Order Management's Product Diagnostic Tools component in E-Business Suite versions 12.2.3 through 12.2.15 can be compromised by a low-privileged authenticated attacker over HTTP, resulting in unauthorized read and write access to Order Management data. The scope change (S:C in CVSS) indicates successful exploitation can cascade to impact additional Oracle EBS modules beyond Order Management itself. Tagged as an Authentication Bypass, no public exploit has been identified at time of analysis, though the patch is included in Oracle's CPU July 2026 release.

Technical ContextAI

Oracle E-Business Suite (EBS) is an integrated enterprise resource planning platform. The vulnerable component is 'Product Diagnostic Tools' within the Order Management module - diagnostic interfaces that are typically intended for administrative troubleshooting and data inspection. The scope change in the CVSS vector (S:C) reflects Oracle EBS's tightly integrated architecture, where a compromise in one module can propagate access or data exposure to adjacent modules sharing the same application tier. No CWE has been assigned, but the 'Authentication Bypass' tag in the source metadata suggests the root cause involves improper authorization or access control checks within the diagnostic tooling endpoint. The attack vector is network-accessible HTTP, consistent with standard EBS application server deployments. Affected versions span 12.2.3 through 12.2.15 per the Oracle advisory and EUVD record EUVD-2026-47155.

RemediationAI

Apply the patches included in Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not provide specific fix version strings in the advisory format used here; consult the CPU patch matrix to identify the correct patch for your 12.2.x release. As a compensating control pending patching, restrict access to the Product Diagnostic Tools component at the application or network layer - disable or block access to diagnostic endpoints for all non-administrative users, since the vulnerable surface is a tooling interface rather than core business functionality. Access controls at the EBS responsibility and menu level may reduce exposure, though these should not be treated as equivalent to patching given the authentication bypass tag. Patch application is the only confirmed remediation; compensating controls carry the trade-off of potentially disrupting legitimate administrative diagnostic workflows.