What is the CVSS score of EUVD-2026-47049?

EUVD-2026-47049 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Oracle EAM EUVD-2026-47049

| CVE-2026-60695 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-rv86-qq3h-hxfg

Authentication Bypass Oracle Enterprise Asset Management

5.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

5.9 MEDIUM

Vendor-provided vector is well-supported: HTTP network access confirmed, high complexity and high privileges stated in description, no availability impact described.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:56 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Enterprise Asset Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Enterprise Asset Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Enterprise Asset Management accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

High-privileged network exploitation of Oracle Enterprise Asset Management's Internal Operations component allows unauthorized read and write access to critical EAM data across versions 12.2.3 through 12.2.15. Tagged as an Authentication Bypass by Oracle, the flaw requires an attacker who already holds high-level privileges to navigate high-complexity conditions over HTTP - suggesting an internal authorization bypass rather than a complete pre-auth bypass. Oracle addressed this in the July 2026 Critical Patch Update; no public exploit or CISA KEV listing exists at time of analysis.

Technical ContextAI

Oracle Enterprise Asset Management is a module within Oracle E-Business Suite, an integrated enterprise resource planning suite used by large organizations for managing physical assets and maintenance operations. The affected component, Internal Operations, handles core EAM processing logic exposed over HTTP. The vendor-applied tag 'Authentication Bypass' indicates the root cause likely involves a failure to enforce authorization checks within this component under specific complex conditions - the absence of a CWE identifier prevents precise root-cause classification. Affected versions span Oracle E-Business Suite releases 12.2.3 through 12.2.15 as confirmed by both Oracle's advisory and the EUVD (EUVD-2026-47049) listing. No CPE string was included in the provided intelligence.

RemediationAI

Apply Oracle's Critical Patch Update released in July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. The provided data does not specify an exact patched release version; administrators should consult Oracle's patch availability matrix for their specific E-Business Suite installation to identify the correct patch bundle for their platform. As a compensating control prior to patching, restrict network access to Oracle EAM Internal Operations endpoints to trusted administrative IP ranges using network ACLs or firewall rules - this limits exposure given the AV:N vector without requiring application changes. Additionally, audit and minimize the population of accounts holding high-privileged EAM roles (PR:H is required), reducing the viable attacker pool even if complex exploitation conditions are met. Note that restricting network access may impact legitimate administrative workflows.