What is the CVSS score of CVE-2026-60919?

CVE-2026-60919 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle iSupplier Portal CVE-2026-60919

EUVD-2026-47186 LOW

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-2cp2-j2pg-97mr

Information Disclosure Oracle Isupplier Portal

3.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.7 LOW

Network-accessible HTTP attack surface with no privileges required per authentication bypass, but AC:H reflects specific exploitation preconditions; C:L only as impact is partial data read with no integrity or availability consequence.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:38 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupplier Portal. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle iSupplier Portal accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthorized read access to Oracle iSupplier Portal (E-Business Suite versions 12.2.3-12.2.15) is possible for unauthenticated network attackers targeting the Internal Operations component over HTTP. The Authentication Bypass tag indicates the root cause involves inadequate access controls on internal HTTP endpoints, though exploitation is constrained by high attack complexity (AC:H), meaning specific conditions must be met. Impact is confined to partial confidentiality loss - no integrity or availability impact - with no public exploit code or active exploitation confirmed at time of analysis.

Technical ContextAI

Oracle iSupplier Portal is a procurement and supplier-collaboration web module within Oracle E-Business Suite (EBS), used by enterprises to manage purchase orders, invoices, and supplier relationships. The affected component, Internal Operations, handles backend processing accessible over HTTP. Although no formal CWE is assigned by Oracle in this advisory, the 'Authentication Bypass' tag points to an access control weakness (broadly aligned with CWE-287 or CWE-306) within this component, where specific internal endpoints may fail to enforce authentication under certain conditions. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms the attack surface is network-reachable without credentials but demands high complexity to exploit, suggesting reliance on particular server-side state, request structure, or timing. Affected product scope is EUVD-confirmed as Oracle iSupplier Portal 12.2.3 ≤ 12.2.15.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU), which addresses this vulnerability; the advisory is published at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not state a specific patched release number beyond the CPU bundle - the fix is integrated into the CPU and organizations should consult Oracle Support for the exact patch artifact applicable to their EBS version. As compensating controls where immediate patching is not feasible, restrict network access to iSupplier Portal Internal Operations endpoints to known-trusted IP ranges or place the portal behind a VPN or reverse proxy that enforces authentication at the perimeter; note that overly restrictive IP allowlisting may disrupt legitimate external supplier access workflows. Additionally, enable HTTP access logging and alert on anomalous unauthenticated requests to internal operation paths as a detection measure.