What is the CVSS score of CVE-2026-60942?

CVE-2026-60942 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Service Fulfillment Manager are affected by CVE-2026-60942?

Oracle Service Fulfillment Manager in E-Business Suite versions 12.2.3-12.2.15 allows authenticated low-privileged users to read, create, modify, or delete all fulfillment data via network access,…

How to fix or mitigate CVE-2026-60942?

Within 24 hours, identify all Oracle E-Business Suite instances in production running versions 12.2.3 through 12.2.15 and classify exposure scope by environment and user base; document which systems process live fulfillment orders. Within 7 days, implement network-level access restrictions limiting Fulfillment Manager module connectivity to authorized systems only, enable comprehensive audit logging of all data access and modifications within the module, and conduct forensic review of access logs for the past 90 days to identify unauthorized data access. Within 30 days, deploy database-level row-level security policies restricting low-privileged user visibility to data, establish automated integrity monitoring of fulfillment records, establish weekly reconciliation controls, and configure alerting for vendor patch release notifications.

Oracle Service Fulfillment Manager CVE-2026-60942

EUVD-2026-47204 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-jxjj-4jfq-6px6

Authentication Bypass Oracle Service Fulfillment Manager

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Remote HTTP reach with low complexity and no UI, but a valid low-privileged account is required (PR:L); full data read and tamper give C:H/I:H, with no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:27 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Service Fulfillment Manager product of Oracle E-Business Suite (component: Fulfillment Engine). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Fulfillment Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Service Fulfillment Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Service Fulfillment Manager accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Service Fulfillment Manager (Fulfillment Engine component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read, create, modify, or delete all data accessible to the module over HTTP. Rated CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, and Oracle labels it easily exploitable. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and Oracle's 'easily exploitable' wording make it a strong patch priority for EBS operators.

Technical ContextAI

Oracle E-Business Suite is Oracle's enterprise ERP platform, and Service Fulfillment Manager (Fulfillment Engine) is the order-orchestration/service-provisioning module within it. The affected surface is the HTTP-facing application tier of EBS 12.2.x. No CWE was assigned by NVD, so the precise root-cause class is unconfirmed; however, the supplied tags cite 'Authentication Bypass,' which together with the impact profile (full read plus create/modify/delete of module data without availability loss) is consistent with a broken-access-control or authorization-bypass weakness that lets an authenticated low-privileged user reach data and operations beyond their intended scope. Exact affected products cannot be pinned to CPE strings because none were provided; version bounds come from the Oracle description and the ENISA EUVD record.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships EBS 12.2 security fixes as cumulative CPU patches rather than a single renamed version, so identify and apply the specific 12.2.x CPU patch for your installed release - patch available per vendor advisory, exact fix build not independently confirmed here. Because exploitation requires an authenticated low-privileged account, interim compensating controls include tightening EBS account provisioning and least-privilege role assignment, restricting network reachability of the Service Fulfillment Manager HTTP endpoints to trusted internal segments or VPN, and increasing monitoring/auditing of create/modify/delete activity against fulfillment data; note these controls reduce exposure but do not close the underlying authorization flaw, and network restrictions may impede legitimate integrations.