What is the CVSS score of CVE-2026-60950?

CVE-2026-60950 has a CVSS 3.1 base score of 2.2 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Oracle HRMS Ireland CVE-2026-60950

EUVD-2026-47208 LOW

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-mjph-hfg9-22j2

Information Disclosure Oracle Human Resources Management System

2.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

2.2 LOW

AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

2.2 LOW

High privileges and high complexity required per description; only partial confidentiality impact with no integrity or availability effect.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:35 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle HRMS (Ireland) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HRMS (Ireland). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle HRMS (Ireland) accessible data. CVSS 3.1 Base Score 2.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Partial confidentiality exposure in Oracle HRMS (Ireland), a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, permits a network-based high-privileged attacker to read a limited subset of HRMS data via HTTP under high-complexity conditions. The impact is confined solely to confidentiality with no integrity or availability consequence, and the CVSS 3.1 base score of 2.2 reflects how constrained exploitation is in practice. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog. Notably, the intelligence tag 'Authentication Bypass' conflicts with the PR:H vector - this discrepancy warrants verification against the Oracle July 2026 CPU advisory.

Technical ContextAI

Oracle HRMS (Ireland) is a localized Human Resources Management System module within Oracle E-Business Suite (EBS), targeting Irish payroll and HR regulatory requirements. The affected component is identified as 'Internal Operations,' likely a back-end processing layer accessible over HTTP. Affected versions span 12.2.3 through 12.2.15, covering a broad swathe of the EBS 12.2 release line. No CWE is assigned, making root-cause classification uncertain from the provided data alone. The 'Authentication Bypass' tag is inconsistent with the PR:H vector, which indicates high-privilege pre-authentication is required; the actual weakness may involve improper access control within an already-authenticated high-privilege context, such as insufficient authorization checks on internal API endpoints or data views accessible to privileged roles.

RemediationAI

Apply the patch provided in Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. The advisory does not specify an exact fixed version in the provided data, so administrators should reference Oracle's patch matrix for the EBS 12.2 line to identify the applicable bundle patch. Given the high attack complexity and privilege requirements, organizations that cannot patch immediately have meaningful compensating controls: restrict network access to Oracle EBS Internal Operations endpoints at the perimeter or application layer firewall to reduce exposure to lower-privilege or unauthenticated network paths; audit and reduce the number of accounts holding high-privilege roles within EBS HRMS (Ireland) to shrink the set of potential attacker starting points; and enable Oracle EBS audit logging on Internal Operations data access to detect anomalous read activity. These mitigations reduce the already-narrow attack surface further but do not eliminate the underlying vulnerability.