What is the CVSS score of EUVD-2026-47101?

EUVD-2026-47101 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by EUVD-2026-47101?

A critical data compromise vulnerability in Oracle E-Business Suite's Trading Community module (CVE-2026-60784) enables low-privileged users to read and modify all trading partner data, affecting…

How to fix or mitigate EUVD-2026-47101?

Within 24 hours, inventory all Oracle EBS 12.2.3 through 12.2.15 instances and implement immediate access restrictions to the Party Search UI component, limiting visibility to essential administrators. Within 7 days, apply Oracle Critical Patch Update July 2026 (CPUJUL2026) to all affected systems using your standard change management process, starting with production environments. Within 30 days, verify deployment of CPUJUL2026 across all systems, review access logs for the vulnerability window for unauthorized data access or modifications, and validate Party Search UI functionality through post-patch testing.

Oracle E-Business Suite EUVD-2026-47101

| CVE-2026-60784 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-m2hf-77hr-4q47

Authentication Bypass Oracle Trading Community

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Remote HTTP access with a required low-privilege account gives AV:N/AC:L/PR:L/UI:N; broad read/modify of party data yields C:H/I:H, with no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:23 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Trading Community product of Oracle E-Business Suite (component: Party Search UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trading Community. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Trading Community accessible data as well as unauthorized access to critical data or complete access to all Oracle Trading Community accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthorized data compromise in Oracle Trading Community (Oracle E-Business Suite, Party Search UI component) allows a low-privileged attacker with network HTTP access to read and modify all data accessible to the Trading Community module. Fixed in the Oracle Critical Patch Update of July 2026 (CPUJUL2026), the flaw affects EBS releases 12.2.3 through 12.2.15 and carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; the vendor tag 'Authentication Bypass' suggests the Party Search UI may permit access beyond the attacker's intended authorization scope.

Technical ContextAI

Oracle Trading Community Architecture (TCA) is the customer/party master data layer underpinning Oracle E-Business Suite, storing organizations, persons, contacts, relationships and account data used across CRM, Order Management and Financials. The affected surface is the Party Search UI, a web-based (HTTP) search interface within EBS. Oracle does not assign a public CWE for this issue (CWE: N/A), but the vendor 'Authentication Bypass' tag combined with the C:H/I:H impact profile points to a broken access-control / authorization root cause (CWE-284/CWE-863 class), where a low-privileged authenticated user can reach party data and mutation operations that should be restricted, rather than a memory-safety or injection defect. Because TCA is shared master data, over-broad access here can expose the full party dataset visible to the module.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (CPUJUL2026) as documented at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle ships EBS security fixes as cumulative patches under the CPU rather than as a single renamed version, so identify and apply the specific 12.2.x patch for your release per that advisory (an exact fixed version string is not provided in the input, so confirm the patch number in the CPU matrix). Until patched, reduce exposure by restricting network reachability of the EBS/Party Search UI - place the instance behind VPN or an authenticated reverse proxy and block direct internet access to the EBS web tier (trade-off: may disrupt external self-service users) - and tighten authorization by auditing and minimizing which application responsibilities/roles grant access to the Party Search UI (trade-off: legitimate users may lose search functionality). Increase monitoring of party-data reads and modifications for anomalous low-privileged account activity as a compensating detective control.