What is the CVSS score of EUVD-2026-47064?

EUVD-2026-47064 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle CMRO EUVD-2026-47064

| CVE-2026-60717 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-4954-m8m8-6mcr

Authentication Bypass Oracle Complex Maintenance Repair And Overhaul

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network HTTP exploitation requires a valid low-privileged account; partial data read and write impacts with no availability impact and unchanged scope align with description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:54 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Common Utilities). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Complex Maintenance, Repair and Overhaul. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Complex Maintenance, Repair and Overhaul accessible data as well as unauthorized read access to a subset of Oracle Complex Maintenance, Repair and Overhaul accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Unauthorized data access in Oracle Complex Maintenance, Repair and Overhaul (CMRO) versions 12.2.3 through 12.2.15 allows low-privileged authenticated attackers with HTTP network access to read a subset of CMRO application data and perform unauthorized insert, update, or delete operations against accessible records via the Common Utilities component. The vulnerability is tagged as an Authentication Bypass, suggesting that despite requiring a low-privileged account, exploitation circumvents authorization controls to access data beyond the attacker's sanctioned scope. No public exploit code or confirmed active exploitation has been identified at time of analysis; the issue was disclosed as part of Oracle's Critical Patch Update for July 2026.

Technical ContextAI

Oracle Complex Maintenance, Repair and Overhaul (CMRO) is an industry-specific module within Oracle E-Business Suite (EBS), primarily deployed in aviation, defense, and heavy-equipment MRO environments. The vulnerable component is 'Common Utilities,' a shared functional layer within CMRO that supports cross-functional operations. The attack is delivered over HTTP with low attack complexity, indicating the flaw is accessible through standard application interaction rather than requiring protocol-level manipulation. No CWE identifier was assigned by NVD, but the 'Authentication Bypass' tag from the intelligence source points toward an authorization control failure - likely in the CWE-285 (Improper Authorization) or CWE-863 (Incorrect Authorization) family - where a low-privileged session can invoke functionality or access data records restricted to higher-privileged roles. The CVSS unchanged scope (S:U) confirms that exploitation is contained within the CMRO application boundary and does not directly affect adjacent EBS modules or the underlying OS.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, documented at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not disclose exact patched release version strings in public CPU summaries; consult the My Oracle Support portal and the CPU advisory detail tables to identify the specific patch number for CMRO on EBS 12.2.x. Patch availability is confirmed by the CPU reference but the exact fix version has not been independently verified from the available data. As a compensating control prior to patching, tighten Oracle EBS role-based access controls to limit which user accounts hold any CMRO Common Utilities entitlements, reducing the pool of accounts capable of reaching the vulnerable component - note that this does not eliminate the vulnerability, only restricts the attacker surface. Additionally, review and audit CMRO access and audit trails for anomalous read or write patterns against data records that low-privileged roles should not ordinarily access.