What is the CVSS score of EUVD-2026-47085?

EUVD-2026-47085 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Oracle Applications DBA EUVD-2026-47085

| CVE-2026-60761 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-cx23-qwm9-5x6h

Authentication Bypass Oracle Applications Dba

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Local vector confirmed by description; PR:L per 'low privileged' qualifier; S:C reflects stated scope change to additional products; only confidentiality impacted.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:51 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Applications DBA executes to compromise Oracle Applications DBA. While the vulnerability is in Oracle Applications DBA, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications DBA accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Local privilege abuse in Oracle Applications DBA (E-Business Suite component: Internal Operations) allows a low-privileged authenticated user with local system access to achieve full confidentiality compromise of DBA-accessible data, with scope change enabling impact on additional Oracle products beyond the directly targeted component. Affected versions span 12.2.3 through 12.2.15, covering a broad range of the E-Business Suite 12.2 release train. No public exploit code or CISA KEV listing has been identified at time of analysis, but Oracle's own advisory classifies the vulnerability as 'easily exploitable,' lowering the bar for threat actors with local infrastructure access.

Technical ContextAI

Oracle Applications DBA (AD/TXK) is an administrative infrastructure component of Oracle E-Business Suite (EBS), responsible for patch application, database tier management, and internal operations within the EBS stack. The vulnerability resides specifically in the Internal Operations subcomponent. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C) indicates a local attack requiring only low-privilege OS-level or application-level access with no complexity barrier and no user interaction - consistent with a flaw in how privileged operations or credentials are managed internally within the DBA tooling. The Scope:Changed metric confirms that successful exploitation transcends the Oracle Applications DBA trust boundary and can affect co-located Oracle components or adjacent database processes. No CWE is formally assigned, but the 'Authentication Bypass' tag from intelligence sources suggests an access control failure in the Internal Operations processing path - where a low-privileged principal can assume elevated data access rights without proper authorization checks.

RemediationAI

Apply Oracle's Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPU patches for E-Business Suite 12.2 are applied via the AD/TXK online patching mechanism; consult Oracle Support for the specific patch number associated with CVE-2026-60761. An exact patched version number was not independently confirmed from the available reference data - validate the specific patch ID through Oracle My Oracle Support before deployment. As a compensating control prior to patching, restrict local logon access to the infrastructure hosts running Oracle Applications DBA to only authorized DBAs and administrators, reducing the pool of potential low-privileged attackers. Audit OS-level and application-level user accounts on EBS application and database tier hosts to identify over-provisioned accounts. Monitoring Internal Operations component activity via Oracle Unified Auditing or EBS audit trails may detect anomalous data access patterns indicative of exploitation.