What is the CVSS score of EUVD-2026-46560?

EUVD-2026-46560 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

E-Business Suite EUVD-2026-46560

| CVE-2026-60154 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-m497-q28w-5wx3

Authentication Bypass Oracle Oracle Application Object Library Oracle Corporation

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-reachable over HTTP with no complexity; valid low-privilege session required; limited partial confidentiality and integrity impact with no availability or scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:29 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

MEDIUM 5.4

DescriptionCVE.org

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Object Library accessible data as well as unauthorized read access to a subset of Oracle Application Object Library accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Oracle Application Object Library (AOL), the foundational Core framework component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, permits a network-authenticated low-privileged user to bypass authorization controls and perform unauthorized read, insert, update, or delete operations on data outside their assigned access scope. Tagged as an Authentication Bypass by ENISA EUVD-2026-46560, the flaw is reachable over HTTP with no attack complexity and no user interaction required beyond a valid low-privilege session. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the low-complexity, broadly network-accessible nature of the flaw in a widely deployed enterprise ERP platform warrants prompt application of Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Application Object Library (AOL) is the core services framework underpinning all Oracle E-Business Suite applications, providing session management, function security enforcement, menu and responsibility-based access control, and data access APIs consumed by every EBS module. The affected CPE (cpe:2.3:a:oracle_corporation:oracle_application_object_library:*:*:*:*:*:*:*:*) spans the entire supported 12.2.x release train from 12.2.3 through 12.2.15. Despite the 'Authentication Bypass' tag from EUVD, the CVSS vector's PR:L metric indicates a valid authenticated session is required; the bypass is more precisely an authorization control failure - a lower-trust user circumventing EBS function security or responsibility-based access controls enforced by AOL's Core component. No CWE is formally assigned by Oracle, but the behavior is consistent with CWE-285 (Improper Authorization) or CWE-863 (Incorrect Authorization). Exploitation is conducted over HTTP, aligning with EBS's standard web-tier delivery model.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU), documented at https://www.oracle.com/security-alerts/cpujul2026.html, to all EBS instances running versions 12.2.3 through 12.2.15; Oracle CPUs are cumulative, so the July 2026 update addresses this and prior issues. The exact patched version number is not independently confirmed outside the Oracle advisory - consult Oracle Support (My Oracle Support Note for the July 2026 CPU) to identify the specific AOL patch number for your EBS release. As a compensating control pending patch deployment, restrict network access to the EBS application tier to only trusted internal network segments and authenticated VPN endpoints, reducing the attacker pool to users already inside the corporate perimeter; note this does not eliminate the vulnerability and will impact legitimate remote EBS users. Additionally, audit EBS responsibility and function security assignments to ensure the principle of least privilege is enforced - removing unnecessary low-privilege accounts reduces exploitation surface without operational downtime. Oracle's CPU advisory should be applied on the standard Oracle patching cycle; delaying beyond 90 days is not advisable given the low attack complexity.