What is the CVSS score of EUVD-2026-47029?

EUVD-2026-47029 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by EUVD-2026-47029?

Oracle E-Business Suite versions 12.2.3 through 12.2.15 contain a critical vulnerability in the Client System Analyzer component that allows unauthenticated network attackers to achieve complete…

How to fix or mitigate EUVD-2026-47029?

Within 24 hours, implement firewall rules to restrict all HTTP/HTTPS access to the Client System Analyzer component to authorized networks only, and enable debug logging on all affected Oracle E-Business Suite instances (versions 12.2.3 through 12.2.15). Within 7 days, complete a comprehensive inventory of affected Oracle E-Business Suite deployments and isolate non-production instances from network access where operationally feasible. Within 30 days, subscribe to Oracle security updates for patch availability, deploy the patch immediately upon release to all affected production systems, and implement network segmentation to place E-Business Suite systems behind additional authentication and access controls independent of vendor patches.

Oracle E-Business Suite EUVD-2026-47029

| CVE-2026-60670 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-q57w-mmwv-4xgp

Authentication Bypass Oracle Applications Technology Stack

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Oracle-confirmed unauthenticated HTTP-reachable flaw (AV:N/PR:N/UI:N) rated difficult to exploit (AC:H), yielding full unscoped compromise (C:H/I:H/A:H) consistent with 'takeover'.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:56 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Applications Technology Stack product of Oracle E-Business Suite (component: Client System Analyzer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Technology Stack. Successful attacks of this vulnerability can result in takeover of Oracle Applications Technology Stack. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of the Oracle Applications Technology Stack is possible in Oracle E-Business Suite 12.2.3 through 12.2.15 via the Client System Analyzer component, which is reachable over HTTP by unauthenticated network attackers. Exploitation is rated difficult (high attack complexity) but a successful attack yields complete confidentiality, integrity, and availability compromise. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The Oracle Applications Technology Stack is the shared middleware/runtime foundation (Oracle HTTP Server, Forms, WebLogic-based services, and Java infrastructure) underpinning the Oracle E-Business Suite ERP platform. The affected surface is the Client System Analyzer (CSA), a browser/applet-based diagnostic utility that gathers client-side system information and posts results back to the E-Business Suite server over HTTP. Oracle assigned no CWE for this entry, but the 'takeover' outcome combined with an HTTP-facing collector endpoint is consistent with an input-handling flaw in the CSA data-submission path; the exact weakness class is not published by Oracle, which is typical for CPU advisories.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships EBS security fixes as cumulative patch bundles for the 12.2 line rather than as a single renamed version, so identify and apply the CPU-Jul-2026 patch level for your exact 12.2.x release through My Oracle Support. Vendor-released patch: per Oracle CPU July 2026 (exact patch number is release-specific and must be pulled from the advisory/MOS, not inferred). As a compensating control until patched, restrict network reachability of the Client System Analyzer submission endpoint - block or ACL external HTTP access to the CSA URL at the reverse proxy / Oracle HTTP Server layer and limit it to the internal management network; if CSA diagnostics are not in active use, disable the module so the endpoint is not served. Trade-off: restricting or disabling CSA removes client diagnostic data collection and may break any workflow that depends on it, so validate against operational needs before enforcing.