What is the CVSS score of EUVD-2026-47071?

EUVD-2026-47071 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

How to fix or mitigate EUVD-2026-47071?

Within 24 hours, inventory all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.12 and immediately restrict Party Search UI access to the minimum necessary high-privilege accounts. Within 7 days, implement network-level or Web Application Firewall rules to detect and block suspicious HTTP requests to the affected component and enable comprehensive audit logging for all Trading Community administrative activities. Within 30 days, contact Oracle support for patch status and approved remediation paths, and execute upgrade to patched versions (12.2.13 or later) or apply vendor-recommended compensating controls.

Oracle Trading Community EUVD-2026-47071

| CVE-2026-60734 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-vgm7-8r7r-fm77

Authentication Bypass Oracle Trading Community

7.2

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate with high-privilege EBS account
Delivery

Reach Party Search UI over HTTP
Exploit

Send crafted search request
Execution

Abuse Party Search flaw
Impact

Take over Trading Community module

Vulnerability Assessment

Weakness	CWE CWE-284 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Access control enforcement MITRE ATT&CK 1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the attacker to already hold high application privileges within Oracle E-Business Suite (CVSS PR:H) and network HTTP access to the EBS application tier hosting the Party Search UI component; affected releases are limited to Oracle Trading Community 12.2.3 through 12.2.12. No user interaction is required (UI:N) and attack complexity is low (AC:L), so a privileged account can trigger it reliably, but the PR:H requirement is the key limiting factor - anonymous or low-privileged users cannot exploit it, confining the realistic threat to malicious privileged insiders or attackers who have first obtained a high-privilege EBS account.
Impact	The CVSS 3.1 base score is 7.2 (High), driven by network attack vector (AV:N), low complexity (AC:L), and no user interaction (UI:N), but critically gated by PR:H - the attacker must already hold high application privileges. This materially lowers real-world risk versus an unauthenticated flaw: the threat model is a malicious or compromised privileged insider/admin account, not an anonymous internet attacker. No EPSS score, KEV listing, or POC was provided, so exploitation probability signals are absent; scope is unchanged (S:U). A notable data conflict exists: the vendor tag labels this 'Information Disclosure' while the CVSS impacts and Oracle's own text ('takeover of Oracle Trading Community') indicate full confidentiality, integrity, and availability compromise - treat this as a takeover-class issue and verify the exact impact with Oracle. Overall this is a genuine but privilege-dependent priority: patch on Oracle's normal CPU cadence, prioritizing environments where TCA privileges are broadly granted.
Exploit ScenarioDerived	A user holding an over-privileged EBS responsibility (or an attacker who has phished/compromised such an account) authenticates to the E-Business Suite web tier and issues crafted HTTP requests to the Party Search UI. Because attack complexity is low and no user interaction is needed, the attacker abuses the flaw to read, alter, or destroy Trading Community party data and take over the module. No public POC was provided, so this scenario is inferred from the CVSS vector and Oracle's description.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Full takeover of the Oracle Trading Community module in Oracle E-Business Suite (versions 12.2.3 through 12.2.12) is achievable by a high-privileged, authenticated attacker sending crafted HTTP requests to the Party Search UI component. Because the CVSS vector reports high impact to confidentiality, integrity, and availability (C:H/I:H/A:H), a successful attack yields complete compromise of the Trading Community application rather than mere data leakage. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

RemediationAI

Apply the fixes delivered in Oracle's Critical Patch Update of July 2026 (Vendor-released patch: Oracle CPU July 2026, https://www.oracle.com/security-alerts/cpujul2026.html); Oracle does not publish a standalone semantic fix version for this component, so identify the applicable EBS 12.2.x patch set for your exact release (12.2.3-12.2.12) from the CPU patch availability matrix and apply it during your next patch window. As compensating controls until patched: tightly restrict which roles/responsibilities can reach the Party Search UI and reduce the number of high-privileged TCA accounts (the exploit requires PR:H), enable and monitor audit logging on party-search activity, and place the EBS application tier behind access controls or a WAF that limits reachability of the Party Search endpoints to trusted internal users - noting that restricting responsibilities may disrupt legitimate customer-data search workflows and should be validated against business processes first.

Affected VersionsENISA

Oracle Trading Community 12.2.3 ≤12.2.12

Affected Packages

euvd oracle_trading_community no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle Trading Community Architecture (TCA) is the customer/party master-data foundation of Oracle E-Business Suite, storing organizations, persons, contacts, and relationships used across CRM, order management, and financials. The flaw resides in the Party Search UI, a web-facing servlet/JSP component reached over HTTP within the EBS application tier (typically fronted by Oracle HTTP Server / WebLogic). No CWE was assigned by Oracle or NVD, so the precise weakness class is unconfirmed; the 'Information Disclosure' tag alongside a full C/I/A impact profile suggests an injection or access-control defect in the search interface that an already-authenticated privileged user can leverage to escalate to control of the module.

Know when Trading Community gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 7.2 HIGH

Reachable over HTTP with low complexity but requires an existing high-privilege EBS account (PR:H); full module takeover yields C:H/I:H/A:H, scope unchanged.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Vulnerability in the Oracle Trading Community product of Oracle E-Business Suite (component: Party Search UI). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Trading Community. Successful attacks of this vulnerability can result in takeover of Oracle Trading Community. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Executive ViewAI

Why It Matters

Oracle E-Business Suite Trading Community module (versions 12.2.3-12.2.12) is vulnerable to complete application takeover by authenticated high-privilege users through crafted HTTP requests to the Party Search UI component. Successful exploitation results in full compromise of confidentiality, integrity, and availability of trading operations and associated data. Organizations running affected versions face operational disruption and regulatory exposure until mitigation is deployed.

Business Impact: High

Compensating Controls

Restrict Party Search UI access to essential high-privilege accounts via role-based access controls; implement network segmentation or WAF policies to block unauthorized HTTP requests to the vulnerable component; enable detailed audit logging of all high-privilege access to Trading Community; reduce the number of high-privilege accounts through principle of least privilege; monitor for suspicious administrative activity targeting the Party Search UI.

Threat Intelligence Overview

EPSS Score

0.5%

Top 62% exploitable

Prevalence

Medium

Oracle EBS is common enterprise ERP; TCA module a subset of installs

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.5%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.