What is the CVSS score of CVE-2026-60922?

CVE-2026-60922 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Oracle iSupplier Portal CVE-2026-60922

EUVD-2026-47188 LOW

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-fcqm-xq5v-698w

Information Disclosure Oracle Isupplier Portal

3.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.1 LOW

Agrees with Oracle's official vector: network-accessible but AC:H limits exploitation; PR:L required; only low confidentiality impact, no integrity or availability effects.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:38 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSupplier Portal. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle iSupplier Portal accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthorized read access to a subset of procurement data is achievable in Oracle iSupplier Portal versions 12.2.3 through 12.2.15 via the Internal Operations component over HTTP, requiring a low-privileged account and difficult attack conditions. The intelligence tags classify this as an Authentication Bypass, creating tension with the official CVSS PR:L metric - if bypass is possible, the real-world requirement may be lower than the vector implies. No public exploit or active exploitation has been identified at time of analysis; this vulnerability is addressed in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle iSupplier Portal is a web-facing module of Oracle E-Business Suite (EBS) 12.2.x that enables supplier self-service for purchase orders, invoices, and procurement workflows over HTTP. The affected component, Internal Operations, handles backend business logic within the portal. No CWE is assigned in available data, but the 'Authentication Bypass' intelligence tag suggests the root cause class involves broken access control or session/authorization handling rather than a classic injection or memory-safety flaw. Affected CPE spans the entire Oracle EBS 12.2 release train from 12.2.3 through 12.2.15, covering a broad range of long-term-support deployments typical of large enterprise Oracle EBS environments.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update for Oracle E-Business Suite, which addresses CVE-2026-60922 in Oracle iSupplier Portal; the advisory is at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched release version is not independently confirmed from available references beyond the CPU release cycle - consult Oracle support for the specific patch identifier applicable to your EBS instance. Prior to patching, restrict network access to the Internal Operations component of iSupplier Portal to only known, trusted supplier IP ranges using network ACLs or a web application firewall, reducing exposure under the AC:H requirement. Additionally, audit low-privileged supplier accounts for anomalous access patterns targeting Internal Operations endpoints. Note that network-layer restrictions may impact supplier self-service availability and should be implemented with change-management oversight.