What is the CVSS score of EUVD-2026-46936?

EUVD-2026-46936 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Oracle Content Manager EUVD-2026-46936

| CVE-2026-60574 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-5p3w-jp4v-8g3w

Authentication Bypass Denial Of Service Oracle Content Manager

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Network-accessible HTTP endpoint, low-privileged account sufficient, no interaction needed, partial CIA impacts confined to the vulnerable system scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:06 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Content Manager product of Oracle E-Business Suite (component: Cover Letter). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Content Manager. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Content Manager accessible data as well as unauthorized read access to a subset of Oracle Content Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Content Manager. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Oracle Content Manager versions 12.2.3 through 12.2.15 within Oracle E-Business Suite expose a medium-severity flaw in the Cover Letter component, exploitable by any low-privileged authenticated user over HTTP without user interaction. Successful exploitation allows unauthorized read access to a subset of Content Manager data, unauthorized insert/update/delete of accessible records, and partial denial of service against the component. No public exploit code and no CISA KEV listing have been identified at time of analysis; this vulnerability was disclosed as part of Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Content Manager is a document management module embedded within Oracle E-Business Suite (EBS), a widely deployed enterprise resource planning platform used by large organizations across industries. The affected subcomponent - Cover Letter - handles document cover letter generation and management within the EBS web application tier, accessible over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates the flaw is reachable over the network with low attack complexity, requiring only a low-privileged EBS user account. No CWE classification was assigned, but the combined C:L/I:L/A:L impact with no scope change is consistent with an insufficient authorization or input validation weakness that allows a restricted user to exceed their intended data access or manipulation boundaries. Affected versions span a wide range - 12.2.3 through 12.2.15 - covering many years of EBS releases.

RemediationAI

Apply the relevant patches from Oracle's Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publish standalone patch version strings in public advisories; consult My Oracle Support (MOS) for the specific patch numbers applicable to your EBS release within the 12.2.3-12.2.15 range. As a compensating control before patching, use Oracle EBS function security and menu exclusion controls to restrict access to the Cover Letter component to only those roles that operationally require it, thereby reducing the pool of users who could reach the vulnerable endpoint. Additionally, if Oracle EBS is not required to be internet-facing, place the application tier behind a VPN or restrict HTTP access to trusted internal network ranges only, limiting network-based exploitation paths. Note that restricting Cover Letter access via function security will impact legitimate use of that feature and should be coordinated with business stakeholders.