What is the CVSS score of CVE-2026-60911?

CVE-2026-60911 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Property Manager CVE-2026-60911

EUVD-2026-47181 MEDIUM

Improper Authorization (CWE-285)

2026-07-21 secalert_us@oracle.com

GHSA-h264-39p3-w77c

Authentication Bypass Oracle Property Manager

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-accessible EBS web app, low privilege required, victim interaction needed, scope change to other EBS modules; no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:39 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Property Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Property Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Property Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Property Manager accessible data as well as unauthorized read access to a subset of Oracle Property Manager accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

AnalysisAI

Unauthorized data access and modification in Oracle Property Manager (Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a network-authenticated low-privileged attacker via HTTP when a victim user interacts with attacker-controlled content, triggering a scope change that may impact additional EBS components. The vulnerability permits unauthorized read access to a subset of Property Manager data and unauthorized insert, update, or delete operations on accessible data. No public exploit code or CISA KEV listing is identified at time of analysis, but the 'Authentication Bypass' tag signals a potential authorization control failure beyond the base CVSS score suggests.

Technical ContextAI

Oracle Property Manager is a module within Oracle E-Business Suite (EBS) used for real estate and lease management in enterprise environments. The affected component is 'Internal Operations,' which handles business logic within the EBS application stack, typically served over HTTP via the Oracle Application Framework (OAF) or Oracle Forms. The CVSS scope change (S:C) flag indicates that successful exploitation can affect EBS components or modules beyond Property Manager itself, consistent with the tightly integrated, shared-session architecture of Oracle EBS. The CWE is not specified by the vendor, but the combination of PR:L, UI:R, S:C, and the 'Authentication Bypass' tag is consistent with a cross-site scripting (XSS) or cross-site request forgery (CSRF) class vulnerability that allows a low-privileged authenticated attacker to act on behalf of a victim user with elevated or different permissions. Affected versions span 12.2.3 through 12.2.15 per NVD CPE data and the ENISA EUVD advisory.

RemediationAI

Apply the patch included in Oracle's Critical Patch Update (CPU) for July 2026, available via the Oracle support portal and referenced at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched version number is not independently confirmed in the available data beyond the advisory reference - consult My Oracle Support (MOS) for the specific patch ID and target release. As a compensating control where immediate patching is not possible, restrict HTTP access to Oracle EBS to trusted internal networks and enforce IP allowlisting for Property Manager module endpoints to reduce the pool of potential attackers who can send crafted requests. Additionally, enforce multi-factor authentication on EBS user accounts to raise the bar for obtaining the low-privilege session prerequisite. Note that these controls reduce but do not eliminate risk since the attack originates from a legitimately authenticated session. Organizations should also monitor EBS access logs for anomalous data access patterns in Property Manager, particularly unexpected cross-user or cross-module data reads and writes.