What is the CVSS score of CVE-2026-60896?

CVE-2026-60896 has a CVSS 3.1 base score of 3.6 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.1%.

Oracle Work in Process CVE-2026-60896

EUVD-2026-47171 LOW

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-r652-qjff-5r53

Denial Of Service Information Disclosure Oracle Work In Process

3.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.6 LOW

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L

vuln.today AI

3.6 LOW

Local infrastructure logon required with high-complexity conditions for limited confidentiality disclosure and partial DoS; no integrity or scope impact; fully consistent with vendor-disclosed vector.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:41 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Work in Process executes to compromise Oracle Work in Process. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Work in Process accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Work in Process. CVSS 3.1 Base Score 3.6 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L).

AnalysisAI

Oracle Work in Process within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes low-privileged local attackers to unauthorized partial data disclosure and partial denial-of-service conditions via the Internal Operations component. Exploitation demands an existing OS-level logon to the host infrastructure and high attack complexity, making reliable exploitation difficult and opportunistic mass exploitation implausible. No public exploit code has been identified and this vulnerability is absent from the CISA KEV catalog, consistent with the vendor-assigned CVSS 3.1 score of 3.6 (Low).

Technical ContextAI

Oracle Work in Process is a discrete module within Oracle E-Business Suite (EBS), an integrated enterprise resource planning platform broadly deployed across manufacturing, supply chain, procurement, and finance verticals. The vulnerable component is identified as 'Internal Operations,' which governs back-end processing logic within the WIP module. No CWE identifier has been assigned, leaving the precise root cause class undisclosed by Oracle; the AV:L/AC:H CVSS vector is consistent with race conditions, insecure inter-process communication, local file permission weaknesses, or privilege-boundary issues within the Oracle process runtime. Affected versions span 12.2.3 through 12.2.15 as confirmed by both NVD and ENISA EUVD-2026-47171. No CPE strings were included in the available intelligence data.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, which addresses this vulnerability across Oracle Work in Process versions 12.2.3 through 12.2.15; the advisory is available at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched release version number is not independently confirmed from available data - consult Oracle My Oracle Support (MOS) for the specific patch ID and bundle applicable to your EBS release. As a compensating control prior to patching, restrict OS-level interactive logon access to application servers hosting Oracle Work in Process to only operationally required accounts; this directly eliminates the PR:L/AV:L attack path. Additionally, audit local user accounts on EBS infrastructure hosts and remove any unnecessary local OS accounts. Note that these access restrictions may impact Oracle DBA or OS-level administration workflows and should be tested before enforcement.