What is the CVSS score of CVE-2026-60939?

CVE-2026-60939 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Oracle Project Contracts CVE-2026-60939

EUVD-2026-47201 LOW

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-wwrx-gmjh-vrrh

Information Disclosure Oracle Project Contracts

3.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.1 LOW

Network access via HTTP confirmed, but AC:H reflects difficult exploit preconditions; PR:L required per description; confidentiality-only impact with no integrity or availability effect.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:36 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Contracts. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Project Contracts accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthorized read access in Oracle Project Contracts (E-Business Suite component: Internal Operations) can be achieved by a low-privileged network attacker under high-complexity exploit conditions, exposing a subset of Project Contracts data. Affected versions span 12.2.3 through 12.2.15, as confirmed by Oracle Security Alerts via the July 2026 Critical Patch Update. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, keeping real-world risk low despite the network-accessible attack surface and the notable 'Authentication Bypass' tag applied by ENISA EUVD.

Technical ContextAI

Oracle Project Contracts is a discrete module within Oracle E-Business Suite (EBS), Oracle's flagship enterprise resource planning platform. The affected component is 'Internal Operations,' which likely governs internal authorization checks or workflow logic within the contracts module. The CVSS vector (AV:N/AC:H/PR:L) indicates the vulnerability is reachable over HTTP but requires an already-authenticated, low-privileged user and specific exploit conditions that are difficult to reproduce - consistent with a partial authorization bypass or an internal access-control flaw rather than a full unauthenticated takeover. The ENISA EUVD tags this as 'Authentication Bypass,' suggesting the root cause involves a failure to enforce internal authorization boundaries, though no formal CWE identifier has been assigned by Oracle or NVD, leaving the precise weakness class unconfirmed. Affected versions are 12.2.3 through 12.2.15, covering a broad range of EBS release lines currently in active Oracle support.

RemediationAI

Apply Oracle's Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle's CPU advisories provide risk matrices and patch instructions for each affected EBS release; administrators should consult the matrix for their specific 12.2.x release line to identify the correct patch bundle. An exact fixed version number was not independently confirmed in the available source data - the CPU advisory should be treated as the authoritative source. As a compensating control prior to patching, consider restricting low-privileged user access to the Internal Operations component of Oracle Project Contracts through EBS function security or responsibility assignments; note that this may disrupt legitimate workflow access for users with valid business need. Network-layer controls (e.g., restricting HTTP access to EBS application servers to trusted subnets) can reduce the attack surface but do not remediate the authorization flaw itself.