What is the CVSS score of CVE-2026-60893?

CVE-2026-60893 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Oracle Payroll CVE-2026-60893

EUVD-2026-47169 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-7w3h-wc7g-j789

Authentication Bypass Oracle Payroll

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Local attack vector and PR:L confirmed by description; scope change and C:H reflect cross-product data access; no integrity or availability impact stated.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:41 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Payroll executes to compromise Oracle Payroll. While the vulnerability is in Oracle Payroll, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Payroll accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Local privilege escalation via authentication bypass in Oracle Payroll (E-Business Suite) versions 12.2.3 through 12.2.15 enables a low-privileged user with infrastructure logon to gain complete unauthorized read access to all Oracle Payroll data, with scope change indicating potential lateral impact to additional EBS components. The CVSS vector confirms local attack vector with low complexity and no user interaction required, making this straightforwardly exploitable by any authenticated OS-level user on the Payroll host. No public exploit code or CISA KEV listing has been identified at time of analysis, but Oracle's 'easily exploitable' language in the advisory warrants prompt patching for any internet-adjacent or multi-tenant EBS deployment.

Technical ContextAI

Oracle Payroll is a component of Oracle E-Business Suite (EBS), a large-scale enterprise resource planning platform. The affected component is 'Internal Operations', which handles backend payroll processing logic running on the infrastructure host. The CVSS vector AV:L indicates exploitation requires a local OS-level session on the host where Oracle Payroll executes - consistent with an EBS application server or database tier node. The Scope:Changed metric indicates that a successful exploit against Oracle Payroll can cascade into unauthorized access of additional EBS products co-hosted or accessible from the same tier. The 'Authentication Bypass' tag suggests the vulnerability enables a low-privileged OS user to circumvent Oracle Payroll's internal access controls - bypassing role-based or session-level authorization checks within the Internal Operations component - rather than requiring no authentication at all. No CWE is assigned by Oracle, which is consistent with their standard CPU advisory format; the root cause class is inferred as access control bypass (likely CWE-284 or CWE-862: Missing Authorization) based on the description and tag.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update (CPU), referenced at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability for Oracle Payroll 12.2.3 through 12.2.15. Oracle does not publish individual patch version numbers in CPU advisories; customers should follow the Oracle patch application instructions for their specific EBS release within the affected range. An exact patched release version was not independently confirmed from the available references. As a compensating control prior to patching, restrict OS-level logon access to the Oracle Payroll application server and database tiers to only essential service accounts and privileged administrators - removing unnecessary user accounts from these hosts directly eliminates the PR:L attack surface. Additionally, audit and tighten OS-level sudo and file permission rules on the Oracle Payroll host. Note that restricting OS access may impact legitimate EBS administration workflows and should be coordinated with EBS administrators. Network-layer controls (firewalls, VPNs) do not mitigate this vulnerability since the attack vector is local.