What is the CVSS score of CVE-2026-60937?

CVE-2026-60937 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Labor Distribution CVE-2026-60937

EUVD-2026-47199 LOW

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-hc6r-r476-qf54

Oracle Authentication Bypass E Business Suite

3.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

3.1 LOW

Network HTTP access required but high complexity limits exploitation; low-privileged account is a firm prerequisite; impact is strictly limited to partial data integrity writes with no confidentiality or availability exposure.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:37 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Labor Distribution. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Labor Distribution accessible data. CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N).

AnalysisAI

Partial data integrity compromise in Oracle Labor Distribution (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged attacker with network access via HTTP to perform unauthorized insert, update, or delete operations on some accessible data within the product's Internal Operations component. The 'Authentication Bypass' tag in the intelligence data is notable but conflicts with the PR:L CVSS metric, suggesting this is more accurately an internal authorization bypass within an authenticated session rather than a full bypass of the login mechanism. No public exploit code exists and the vulnerability is not listed in CISA KEV; with a CVSS 3.1 score of 3.1 (Low) and AC:H, this represents a low-priority finding for most environments.

Technical ContextAI

Oracle Labor Distribution is a payroll costing and effort-reporting module within Oracle E-Business Suite (EBS), a large-scale enterprise ERP platform delivered over HTTP/HTTPS. The affected component, Internal Operations, handles backend allocation and costing workflows exposed through Oracle EBS's web application layer. The attack vector is network-based HTTP access (AV:N), consistent with EBS's browser-driven interface. No CWE identifier was assigned in the available data, but the 'Authentication Bypass' tag combined with an integrity-only impact profile is consistent with an authorization control flaw - likely CWE-284 (Improper Access Control) or CWE-285 (Improper Authorization) - where a low-privileged EBS user can exceed their intended data permissions within the module. No CPE string was provided in the input, but Oracle's advisory confirms the affected range as Oracle E-Business Suite 12.2 family versions 12.2.3 through 12.2.15.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, referenced at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPUs are cumulative, so applying this update to affected EBS 12.2.3-12.2.15 installations should remediate the vulnerability; however, the exact patched release version is not independently confirmed from the available references and should be verified against Oracle's patch readme. As a compensating control prior to patching, restrict access to the Labor Distribution Internal Operations component using Oracle EBS Function Security and Responsibility assignments, ensuring only users with a legitimate business need can reach these endpoints - this directly reduces the pool of potential low-privileged accounts that could satisfy the PR:L prerequisite. Additionally, network-layer controls such as firewall rules limiting HTTP access to Oracle EBS to trusted internal IP ranges can reduce exposure, with the trade-off of affecting legitimate remote users who require EBS access.