What is the CVSS score of CVE-2026-60957?

CVE-2026-60957 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Transportation Execution CVE-2026-60957

EUVD-2026-47212 MEDIUM

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-7vpq-54hg-3r64

Privilege Escalation Oracle E Business Suite

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-accessible client-side vector requiring low-privilege auth and victim interaction; scope change to adjacent EBS components; no availability impact confirmed.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:35 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Transportation Execution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Transportation Execution. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Transportation Execution, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Transportation Execution accessible data as well as unauthorized read access to a subset of Oracle Transportation Execution accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

AnalysisAI

Cross-product data exposure in Oracle Transportation Execution (E-Business Suite 12.2.3-12.2.15) allows an authenticated low-privileged attacker over HTTP to read and modify a subset of Transportation data while also impacting additional EBS products due to a scope change. The attack requires victim interaction, suggesting a client-side injection vector (consistent with the 'Authentication Bypass' tag and scope change in the CVSS vector), where attacker-controlled content is rendered by another user. Disclosed in Oracle's July 2026 Critical Patch Update with no confirmed public exploit or CISA KEV listing at time of analysis.

Technical ContextAI

Oracle Transportation Execution is a module within Oracle E-Business Suite (EBS), a large-scale enterprise resource planning platform widely used in logistics and supply chain management. The vulnerability resides in the 'Internal Operations' component and spans supported release versions 12.2.3 through 12.2.15. No CWE is formally assigned, but the combination of the 'Authentication Bypass' tag, scope change (S:C), and required user interaction (UI:R) is strongly consistent with a client-side injection class - most likely stored or reflected cross-site scripting (XSS) - where an attacker with low-level authenticated access can plant or deliver malicious content that is executed in another user's browser session. The S:C (scope change) metric indicates that the exploited component is distinct from the affected component, meaning successful exploitation can cascade beyond the Transportation Execution module to influence other EBS application contexts within the same browser origin or session.

RemediationAI

Apply the patches distributed by Oracle as part of the July 2026 Critical Patch Update (CPU), available at https://www.oracle.com/security-alerts/cpujul2026.html. An exact fixed version number beyond the CPU reference was not confirmed in the provided data - administrators should consult the CPU document for the specific patch identifier applicable to their installed release within the 12.2.3-12.2.15 range. As a compensating control prior to patching, restrict access to the Internal Operations component to only those users who require it, and review role-based access controls within EBS to limit the population of low-privileged users who could trigger the vector. If an XSS-class vector is confirmed by Oracle's advisory detail, enforcing Content Security Policy headers at the web application layer and disabling rich-text or HTML input fields in the affected component can reduce attack surface. Note that access restriction does not eliminate the underlying flaw and should not substitute for patching.