What is the CVSS score of CVE-2026-60940?

CVE-2026-60940 has a CVSS 3.1 base score of 5.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Oracle Service Contracts CVE-2026-60940

EUVD-2026-47202 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-vc4r-x3gh-jrjj

Authentication Bypass Oracle Service Contracts

5.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.7 MEDIUM

AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

5.7 MEDIUM

Network vector confirmed by HTTP access; AC:H reflects difficult exploitation conditions; PR:H per high-privilege requirement; UI:R per description; no availability impact stated.

3.1 AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:35 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Service Contracts product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Service Contracts. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Service Contracts accessible data as well as unauthorized access to critical data or complete access to all Oracle Service Contracts accessible data. CVSS 3.1 Base Score 5.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N).

AnalysisAI

Oracle Service Contracts (E-Business Suite versions 12.2.3-12.2.15) exposes a network-accessible integrity and confidentiality flaw in its Internal Operations component that allows a high-privileged, authenticated attacker to bypass authorization controls and gain unauthorized read or write access to all Service Contracts data. The attack is rated difficult to exploit and requires human interaction from a third party, substantially limiting opportunistic exploitation. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, though the 'Authentication Bypass' tag signals a meaningful authorization control gap rather than a simple privilege escalation.

Technical ContextAI

Oracle Service Contracts is a module of the Oracle E-Business Suite (EBS) platform, a large-scale enterprise resource planning application used for managing customer service agreements, warranties, and entitlements. The affected component is 'Internal Operations,' suggesting the flaw lies in back-end business logic or API-layer authorization. The 'Authentication Bypass' tag indicates that despite requiring high privileges to initiate an attack (PR:H), the vulnerability enables circumvention of finer-grained authorization checks - a pattern common in EBS where role-based access controls can be undermined by direct object reference manipulation or improperly secured internal endpoints. No CWE is formally assigned, but the behavior most closely maps to CWE-863 (Incorrect Authorization) or CWE-284 (Improper Access Control). Affected CPE strings were not provided, but the advisory scopes the flaw to EBS versions 12.2.3 through 12.2.15.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, available via Oracle support at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle's CPU process delivers patches cumulatively, so applying the July 2026 CPU to affected EBS 12.2.3-12.2.15 installations should address this vulnerability; the exact patched release version is not independently confirmed in available references beyond the advisory itself. As a compensating control pending patching, restrict network access to EBS Internal Operations endpoints at the network or WAF layer, limiting reachability to trusted internal IP ranges only - note this may impact legitimate high-privileged administrative workflows. Additionally, review and audit high-privilege role assignments within Oracle Service Contracts to minimize the number of accounts that meet the PR:H precondition. The UI:R requirement means disabling or sandboxing user interaction pathways (e.g., preventing external links in EBS notifications) reduces the practical attack surface. Oracle's quarterly CPU cadence means this advisory may not receive an out-of-band patch; plan for deployment within the next patch maintenance window.