What is the CVSS score of CVE-2026-60962?

CVE-2026-60962 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Flow Manufacturing CVE-2026-60962

EUVD-2026-47215 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-cwmp-4269-3mmq

Authentication Bypass Oracle E Business Suite

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Low-privilege authenticated network attacker, victim interaction required, scope change affects adjacent EBS modules, no availability impact identified.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:34 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Flow Manufacturing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Flow Manufacturing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Flow Manufacturing accessible data as well as unauthorized read access to a subset of Oracle Flow Manufacturing accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

AnalysisAI

Unauthorized data access and modification in Oracle Flow Manufacturing (component: Internal Operations) allows a low-privileged, network-adjacent attacker to compromise confidentiality and integrity of Flow Manufacturing data, with a scope change that may impact additional Oracle E-Business Suite products. Affected versions span 12.2.3 through 12.2.15, a wide deployment window covering over a decade of releases. The attack requires human interaction from a victim beyond the attacker, suggesting a social-engineering or UI-based exploitation vector. No public exploit code or CISA KEV listing has been identified at time of analysis; this is a medium-severity finding addressed in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Flow Manufacturing is a component of Oracle E-Business Suite (EBS), an enterprise resource planning suite widely used in discrete and process manufacturing industries. The Internal Operations sub-component handles scheduling, work-in-progress, and supply chain workflows. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C) describes a network-reachable, low-complexity attack over HTTP that requires low-privilege authentication and human interaction - a pattern consistent with stored cross-site scripting (XSS) or cross-site request forgery (CSRF), where an authenticated attacker injects a payload that executes in a victim's session, potentially escalating impact to other EBS modules (the Scope Change). The CWE classification was not provided by NVD, but the 'Authentication Bypass' tag from the intelligence feed suggests the exploitation path may allow a low-privileged attacker to access or modify data beyond their authorization boundary, potentially leveraging the scope change to affect adjacent EBS components. Affected CPE is Oracle E-Business Suite, Oracle Flow Manufacturing versions 12.2.3 through 12.2.15.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU), available via My Oracle Support and described at https://www.oracle.com/security-alerts/cpujul2026.html; the CPU addresses CVE-2026-60962 for all affected 12.2.x releases. Oracle does not publish exact patched version numbers separately from the CPU bundle - customers should apply the full July 2026 CPU to their E-Business Suite environment. As a compensating control prior to patching, restrict access to the Internal Operations component of Flow Manufacturing to the minimum required user set, as the vulnerability requires a low-privileged authenticated user to initiate the attack. Additionally, enforcing strict review of EBS user account provisioning limits the attacker pool. Monitoring application logs for anomalous data access patterns in Flow Manufacturing may assist in early detection. Note that restricting UI access may impact legitimate manufacturing operations users and should be evaluated against operational requirements.