What is the CVSS score of CVE-2026-60959?

CVE-2026-60959 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-60959?

Oracle E-Business Suite Number Portability module (versions 12.2.3-12.2.15) contains a high-severity vulnerability (CVSS 8.1) enabling unauthorized read and write access to Internal Operations data…

How to fix or mitigate CVE-2026-60959?

Within 24 hours: identify all systems running Oracle E-Business Suite versions 12.2.3 through 12.2.15 and assess network exposure of the SDP Number Portability module; implement network access controls restricting HTTP connections to this module to trusted internal IP ranges only. Within 7 days: enable comprehensive audit logging for all data access and modification operations in the Internal Operations component; apply any interim security configurations from Oracle's July 2026 Critical Patch Update; review and tighten identity and access controls for accounts with low-privilege access to this module. Within 30 days: establish a formal process to track Oracle patch releases and delivery timeline; develop and test a staged upgrade plan to transition affected systems to unaffected versions; conduct a forensic review of access logs during the interim period to identify any unauthorized access attempts.

Oracle E-Business Suite CVE-2026-60959

EUVD-2026-47213 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-469j-292m-97jq

Authentication Bypass Oracle Service Delivery Platform Number Portability

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reach with low complexity, but requires a low-privilege authenticated account (PR:L); full data read/write gives C:H/I:H while no service disruption gives A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:24 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle SDP Number Portability product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SDP Number Portability. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle SDP Number Portability accessible data as well as unauthorized access to critical data or complete access to all Oracle SDP Number Portability accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthorized read and write access to Oracle SDP Number Portability (Oracle E-Business Suite, Internal Operations component) is achievable by a low-privileged, network-based attacker over HTTP in versions 12.2.3 through 12.2.15. Oracle rates this 8.1 (High) with high confidentiality and integrity impact, allowing an authenticated user to create, delete, or modify all data accessible to the module. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network reach make it a notable patching priority in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle SDP (Service Delivery Platform) Number Portability is a telecom-oriented module within the Oracle E-Business Suite applications stack, exposed through the EBS web tier over HTTP. The Internal Operations component handles back-office operational functions, and the flaw is reachable by an already-authenticated low-privilege account rather than requiring administrative rights. No CWE was assigned by NVD/Oracle; the community-supplied tag 'Authentication Bypass' suggests the underlying weakness may permit an authenticated user to bypass access-control checks and reach data or operations beyond their intended authorization, though Oracle's own bulletin does not classify the root cause. The affected code path is part of the standard EBS 12.2 release line (12.2.3-12.2.15).

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships EBS security fixes as cumulative CPU patches for the 12.2 release line, so apply the current CPU patch level for your 12.2.x installation - no standalone fixed version number was published in the provided data beyond the affected 12.2.3-12.2.15 range, so consult the CPU patch matrix for the exact patch ID matching your version. Until patching, reduce exposure by restricting network access to the EBS web tier and the SDP Number Portability endpoints to trusted internal networks or VPN, tightening provisioning so low-privilege accounts cannot reach the Internal Operations functions, and monitoring EBS application logs for anomalous create/delete/modify activity on Number Portability data; note that restricting endpoint access may disrupt legitimate integrations or self-service users and should be validated against business workflows before enforcement.