What is the CVSS score of CVE-2026-60907?

CVE-2026-60907 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Oracle Installed Base CVE-2026-60907

EUVD-2026-47178 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-699f-c755-h6mq

Authentication Bypass Denial Of Service Oracle Installed Base

5.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.0 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

5.0 MEDIUM

Network-accessible HTTP attack requiring authenticated low-privilege account and high complexity; partial and equal CIA impacts confined to Installed Base with no scope change.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:40 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance). Supported versions that are affected are 12.2.4-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Installed Base accessible data as well as unauthorized read access to a subset of Oracle Installed Base accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Installed Base. CVSS 3.1 Base Score 5.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Partial compromise of Oracle Installed Base (Create Item Instance component) within Oracle E-Business Suite versions 12.2.4 through 12.2.15 is achievable by a low-privileged authenticated attacker over HTTP, subject to high attack complexity conditions. Successful exploitation results in unauthorized read access to a subset of Installed Base data, unauthorized data manipulation (insert/update/delete), and the ability to cause a partial denial of service. No public exploit or active exploitation has been identified at time of analysis; the Oracle CPU July 2026 advisory addresses this issue.

Technical ContextAI

Oracle Installed Base is an asset-lifecycle management module within Oracle E-Business Suite (EBS), used by enterprises to track physical and logical assets across their organizations. The affected component, Create Item Instance, is part of the asset creation workflow accessible over HTTP. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U) indicates the vulnerability is network-reachable via standard HTTP but requires high attack complexity, suggesting the exploit window involves specific timing, state, or configuration conditions rather than straightforward request-based triggering. No CWE identifier has been assigned, meaning the root cause class (e.g., injection, improper authorization, race condition) cannot be confirmed from available data. The unchanged scope (S:U) confirms impact is confined to the Oracle Installed Base module itself.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability in Oracle Installed Base versions 12.2.4 through 12.2.15. An exact patched build or sub-version number is not independently confirmed from the available data beyond the CPU publication - consult My Oracle Support for the specific patch identifier. As a compensating control prior to patching, organizations can restrict network access to the Oracle EBS HTTP endpoints associated with the Create Item Instance component at the network or WAF layer, limiting exposure to trusted IP ranges. This trade-off is that legitimate low-privileged users needing asset creation functionality may be impacted. Additionally, reviewing and tightening role-based access controls within EBS to ensure only necessary users hold the privilege to invoke Create Item Instance reduces the attacker pool that can meet the PR:L prerequisite.