What is the CVSS score of CVE-2026-60941?

CVE-2026-60941 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Service Fulfillment Manager are affected by CVE-2026-60941?

Oracle Service Fulfillment Manager (Oracle E-Business Suite) contains a critical vulnerability (CVE-2026-60941, CVSS 8.7) allowing authenticated attackers with high privileges to read, modify, or…

How to fix or mitigate CVE-2026-60941?

Within 24 hours, conduct an inventory of all systems running Oracle E-Business Suite versions 12.2.3-12.2.15 and identify those with the Fulfillment Engine component exposed; immediately audit high-privileged user accounts and restrict HTTP network access to the Fulfillment Engine to essential users and systems only. Within 7 days, enable and review all access and transaction logs for anomalous activity, assess the sensitivity and scope of data in affected systems, and establish a formal patch deployment plan with your Oracle support team. Within 30 days, apply the vendor patch immediately upon release (monitor Oracle's Critical Patch Update schedule and the July 2026 update closely), or if patches remain unavailable, implement comprehensive network segmentation, multi-factor authentication for privileged accounts, and increased audit logging across the affected E-Business Suite instance.

Oracle Service Fulfillment Manager CVE-2026-60941

EUVD-2026-47203 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-jf2r-ppwp-632c

Authentication Bypass Privilege Escalation Oracle Service Fulfillment Manager

8.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.7 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

Network HTTP access with low complexity but requires an existing high-privileged EBS account (PR:H); scope change per vendor; full C/I loss, no availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:28 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.7

DescriptionCVE.org

Vulnerability in the Oracle Service Fulfillment Manager product of Oracle E-Business Suite (component: Fulfillment Engine). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Service Fulfillment Manager. While the vulnerability is in Oracle Service Fulfillment Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Service Fulfillment Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Service Fulfillment Manager accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Service Fulfillment Manager (Fulfillment Engine component of Oracle E-Business Suite) allows a high-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all data accessible to the application, with a scope change that may significantly impact additional Oracle products. Affected releases span 12.2.3 through 12.2.15, and Oracle rates it CVSS 8.7 (confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it is addressed in the Oracle July 2026 Critical Patch Update.

Technical ContextAI

Oracle Service Fulfillment Manager is an order-fulfillment orchestration module within the Oracle E-Business Suite (EBS) application stack, reached over HTTP through the EBS web tier. The vulnerable Fulfillment Engine component processes fulfillment workflow requests server-side. No CWE was assigned by NVD, so the precise weakness class is not formally categorized; the vendor tag 'Authentication Bypass' conflicts with the CVSS PR:H metric (which requires the attacker to already hold high privileges), so the true root cause cannot be confirmed from available data. The CVSS scope change (S:C) indicates exploitation crosses a trust/authorization boundary, letting impact extend beyond Service Fulfillment Manager into other integrated EBS components. No CPE strings were provided; affected products are identified only by Oracle/EUVD version ranges.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected Oracle E-Business Suite 12.2.x releases; Oracle does not publish a discrete component build number in the alert, so apply the CPU patch corresponding to your EBS 12.2.3-12.2.15 level - Patch available per vendor advisory. As compensating controls until patching, restrict HTTP access to Service Fulfillment Manager and the EBS web tier to trusted internal networks or VPN rather than exposing it to the internet (trade-off: may disrupt remote/partner order-fulfillment integrations), and tighten and audit assignment of high-privileged EBS responsibilities/accounts since exploitation requires PR:H (trade-off: administrative overhead and possible friction for legitimate power users). Enable and monitor logging on fulfillment endpoints to detect anomalous data modification by privileged accounts.