What is the CVSS score of CVE-2026-60891?

CVE-2026-60891 has a CVSS 3.1 base score of 1.9 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Oracle Work in Process CVE-2026-60891

EUVD-2026-47167 LOW

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-hcv9-fwj4-m5hf

Information Disclosure Oracle Work In Process

1.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

1.9 LOW

AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

1.9 LOW

Local access, high complexity, and high privileges required per description; confidentiality impact only, limited in scope.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:42 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Work in Process executes to compromise Oracle Work in Process. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Work in Process accessible data. CVSS 3.1 Base Score 1.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Limited local data disclosure in Oracle Work in Process (E-Business Suite component: Internal Operations) versions 12.2.3 through 12.2.15 allows a high-privileged attacker with local infrastructure access to read a subset of accessible data under difficult exploitation conditions. The CVSS 3.1 base score of 1.9 reflects an extremely constrained attack surface - local vector, high complexity, and high privilege requirements combine to make this one of the lowest-severity issues addressed in the Oracle CPU July 2026 advisory. No public exploit identified at time of analysis, and no active exploitation has been reported.

Technical ContextAI

Oracle Work in Process is a supply chain and manufacturing execution module within Oracle E-Business Suite (EBS), handling production orders, work orders, and shop floor operations. Affected versions span 12.2.3 through 12.2.15. No CWE identifier was provided by Oracle, which is consistent with their general practice of not disclosing root-cause weakness classifications. The vulnerability resides in the Internal Operations sub-component, implying it may relate to backend processing logic or inter-module communication within the EBS infrastructure. The local attack vector (AV:L) indicates the flaw is exercisable only from within the host OS or infrastructure layer where Oracle WIP runs, rather than over a network. The 'Authentication Bypass' tag supplied in the intelligence metadata is notably inconsistent with the CVSS PR:H designation and should be treated with caution pending vendor clarification.

RemediationAI

Apply the patch issued by Oracle in the Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number was not independently confirmed from the available references - consult the Oracle CPU July 2026 advisory directly for the specific patch set applicable to the 12.2.x EBS release in use. Given the local-only, high-privilege attack vector, compensating controls for organizations that cannot patch immediately include restricting OS-level logon access to the infrastructure hosts running Oracle WIP to only strictly necessary service accounts and administrators, and auditing privileged account membership on those hosts. These controls directly address the PR:H/AV:L prerequisites and effectively neutralize the attack surface without operational side effects. No workarounds are documented in the available references.