What is the CVSS score of CVE-2026-60960?

CVE-2026-60960 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Service Delivery Platform Number Portability are affected by CVE-2026-60960?

Oracle Service Delivery Platform (SDP) Number Portability component in E-Business Suite versions 12.2.3-12.2.15 is vulnerable to full system compromise by low-privilege authenticated users with host…

How to fix or mitigate CVE-2026-60960?

Within 24 hours, conduct an inventory of all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15 and map their network connectivity to downstream systems; immediately restrict host-level access to the SDP component to administrative accounts only using OS-level access controls. Within 7 days, implement network segmentation to isolate affected systems from critical downstream applications, enable detailed audit logging and real-time alerting on privileged account activity, and document baseline behaviors for anomaly detection. Within 30 days, establish a continuous monitoring protocol for Oracle security advisories; simultaneously, schedule a technical assessment for upgrading affected E-Business Suite instances to versions 12.2.16 or later, prioritizing systems with access to mission-critical downstream applications.

Service Delivery Platform Number Portability CVE-2026-60960

EUVD-2026-47214 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-g3xq-9w82-pqcx

Authentication Bypass Oracle Service Delivery Platform Number Portability

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:24 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle SDP Number Portability product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle SDP Number Portability executes to compromise Oracle SDP Number Portability. While the vulnerability is in Oracle SDP Number Portability, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle SDP Number Portability. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle SDP Number Portability (a Service Delivery Platform component of Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged attacker who already holds a logon on the host where the product runs; because the CVSS scope is changed, a successful attack can pivot to significantly impact other products beyond the vulnerable component. The flaw yields high confidentiality, integrity and availability impact and results in product takeover. No public exploit identified at time of analysis, and it is not listed in CISA KEV.