What is the CVSS score of EUVD-2026-47071?

EUVD-2026-47071 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Trading Community are affected by EUVD-2026-47071?

Oracle E-Business Suite Trading Community module (versions 12.2.3-12.2.12) is vulnerable to complete application takeover by authenticated high-privilege users through crafted HTTP requests to the…

How to fix or mitigate EUVD-2026-47071?

Within 24 hours, inventory all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.12 and immediately restrict Party Search UI access to the minimum necessary high-privilege accounts. Within 7 days, implement network-level or Web Application Firewall rules to detect and block suspicious HTTP requests to the affected component and enable comprehensive audit logging for all Trading Community administrative activities. Within 30 days, contact Oracle support for patch status and approved remediation paths, and execute upgrade to patched versions (12.2.13 or later) or apply vendor-recommended compensating controls.

Oracle Trading Community EUVD-2026-47071

| CVE-2026-60734 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-vgm7-8r7r-fm77

Authentication Bypass Oracle Trading Community

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Reachable over HTTP with low complexity but requires an existing high-privilege EBS account (PR:H); full module takeover yields C:H/I:H/A:H, scope unchanged.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:26 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Trading Community product of Oracle E-Business Suite (component: Party Search UI). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Trading Community. Successful attacks of this vulnerability can result in takeover of Oracle Trading Community. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of the Oracle Trading Community module in Oracle E-Business Suite (versions 12.2.3 through 12.2.12) is achievable by a high-privileged, authenticated attacker sending crafted HTTP requests to the Party Search UI component. Because the CVSS vector reports high impact to confidentiality, integrity, and availability (C:H/I:H/A:H), a successful attack yields complete compromise of the Trading Community application rather than mere data leakage. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

Oracle Trading Community Architecture (TCA) is the customer/party master-data foundation of Oracle E-Business Suite, storing organizations, persons, contacts, and relationships used across CRM, order management, and financials. The flaw resides in the Party Search UI, a web-facing servlet/JSP component reached over HTTP within the EBS application tier (typically fronted by Oracle HTTP Server / WebLogic). No CWE was assigned by Oracle or NVD, so the precise weakness class is unconfirmed; the 'Information Disclosure' tag alongside a full C/I/A impact profile suggests an injection or access-control defect in the search interface that an already-authenticated privileged user can leverage to escalate to control of the module.

RemediationAI

Apply the fixes delivered in Oracle's Critical Patch Update of July 2026 (Vendor-released patch: Oracle CPU July 2026, https://www.oracle.com/security-alerts/cpujul2026.html); Oracle does not publish a standalone semantic fix version for this component, so identify the applicable EBS 12.2.x patch set for your exact release (12.2.3-12.2.12) from the CPU patch availability matrix and apply it during your next patch window. As compensating controls until patched: tightly restrict which roles/responsibilities can reach the Party Search UI and reduce the number of high-privileged TCA accounts (the exploit requires PR:H), enable and monitor audit logging on party-search activity, and place the EBS application tier behind access controls or a WAF that limits reachability of the Party Search endpoints to trusted internal users - noting that restricting responsibilities may disrupt legitimate customer-data search workflows and should be validated against business processes first.