What is the CVSS score of CVE-2026-60938?

CVE-2026-60938 has a CVSS 3.1 base score of 4.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Oracle Labor Distribution CVE-2026-60938

EUVD-2026-47200 MEDIUM

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-3v34-jwv9-79qh

Oracle Privilege Escalation E Business Suite

4.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.1 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

4.1 MEDIUM

Local-only exploitation with high privileges and high complexity required; integrity-only impact matches described unauthorized data modification with no confidentiality or availability dimension.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:36 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Labor Distribution executes to compromise Oracle Labor Distribution. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Labor Distribution accessible data. CVSS 3.1 Base Score 4.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N).

AnalysisAI

Oracle Labor Distribution, an Internal Operations component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, permits a high-privileged local attacker to compromise data integrity by creating, deleting, or modifying critical application data. Despite carrying an 'Authentication Bypass' tag in available intelligence, the CVSS vector (AV:L/AC:H/PR:H) constrains exploitation to actors who already possess elevated logon access to the underlying infrastructure - suggesting an internal authorization bypass rather than a full authentication circumvention. No public exploit code exists and no active exploitation has been identified; this was disclosed as part of Oracle's Critical Patch Update for July 2026.

Technical ContextAI

Oracle Labor Distribution is a payroll cost distribution module within Oracle E-Business Suite (EBS), responsible for distributing labor costs across funding sources. The vulnerable component is identified as 'Internal Operations,' indicating a flaw within application-layer logic rather than a database or OS primitive. No CWE has been assigned, precluding definitive root-cause classification. The CVSS vector AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N indicates: local-only attack surface, high attack complexity (specific preconditions must be met), and high privilege requirements, with integrity as the sole impacted dimension. Affected versions span Oracle EBS 12.2.3 through 12.2.15. No explicit CPE string was provided in the intelligence data, but the scope aligns with Oracle EBS 12.2.x release family. The 'Authentication Bypass' tag is notable in tension with the PR:H metric - it likely describes an internal authorization control bypass accessible only to already-privileged actors, not a pre-auth bypass.

RemediationAI

Apply Oracle's Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability. An exact patched release version is not independently specified in the available intelligence - consult the Oracle CPU documentation directly for patch identifiers applicable to your EBS installation. As a compensating control prior to patching, restrict local infrastructure logon access to the servers executing Oracle Labor Distribution to only those roles operationally required, directly reducing the attacker pool that satisfies the PR:H prerequisite. Additionally, implement privileged session monitoring and audit logging on affected systems to detect unauthorized data modification attempts. Note that access restriction does not eliminate the vulnerability - it only narrows exposure until the official patch is applied.