What is the CVSS score of EUVD-2026-47103?

EUVD-2026-47103 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Receivables are affected by EUVD-2026-47103?

Oracle Receivables (E-Business Suite versions 12.2.3-12.2.15) is vulnerable to full system compromise via HTTP access by high-privilege users, directly threatening financial data integrity and…

How to fix or mitigate EUVD-2026-47103?

Within 24 hours: Inventory all Oracle EBS 12.2.x Receivables instances in production and document current access controls. Within 7 days: Implement strict role-based access controls limiting Receivables administrative functions to essential personnel, enforce multi-factor authentication for all privileged operations, and enable enhanced audit logging on Receivables module activities. Within 30 days: Contact Oracle Support to obtain available mitigations for versions 12.2.3-12.2.15, evaluate patch release timelines, and develop upgrade strategy to newer Oracle EBS versions.

Oracle Receivables EUVD-2026-47103

| CVE-2026-60786 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-r52c-78hj-q877

Authentication Bypass Oracle Receivables

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network HTTP reachable and low complexity, but requires existing high EBS privileges (PR:H); full module takeover yields C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:23 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Receivables product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Receivables. Successful attacks of this vulnerability can result in takeover of Oracle Receivables. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Receivables (Oracle E-Business Suite, Internal Operations component) is possible in versions 12.2.3 through 12.2.15, where a high-privileged attacker with network HTTP access can take over the module, impacting confidentiality, integrity, and availability. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable, though it requires existing high privileges (PR:H). No public exploit has been identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Receivables is the accounts-receivable module of Oracle E-Business Suite (EBS), Oracle's on-premises ERP platform, and the flaw sits in its Internal Operations component reached over HTTP. Oracle does not publish a CWE for this issue (CWE: N/A) and gives no root-cause class in the advisory, so the specific weakness (e.g., authorization, injection, or logic flaw) cannot be determined from available data. The 'takeover of Oracle Receivables' language combined with C:H/I:H/A:H indicates the vulnerability yields full control of the module's data and functions rather than a narrow disclosure, despite the vendor tag of 'Information Disclosure.'

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle delivers EBS 12.2 security fixes as cumulative CPU patches for the 12.2 codeline rather than as a new base version, so identify and apply the specific CPU patch for your 12.2.x level (no exact fixed-version string is provided in the input, so confirm the patch number in the CPU matrix). Until patched, reduce exposure by restricting network HTTP access to the EBS/Oracle Receivables endpoints to trusted internal networks or VPN, tightening and reviewing accounts that hold high EBS privileges since exploitation requires PR:H (revoke unneeded elevated roles, enforce strong authentication/MFA), and increasing monitoring of privileged Receivables activity - trade-offs include potential disruption to legitimate remote or integration access when restricting the front end. Because Oracle CPU details are cumulative, applying the CPU also remediates other July 2026 EBS issues.