What is the CVSS score of EUVD-2026-47108?

EUVD-2026-47108 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Telesales are affected by EUVD-2026-47108?

Oracle TeleSales within E-Business Suite versions 12.2.3 through 12.2.15 contains an authentication-bypass vulnerability enabling low-privileged attackers with network access to read, modify, or…

How to fix or mitigate EUVD-2026-47108?

Within 24 hours, identify and document all deployed Oracle E-Business Suite instances running TeleSales versions 12.2.3 through 12.2.15, and assess their network exposure to determine which systems can be safely isolated pending remediation. Within 7 days, implement layered network access controls restricting TeleSales HTTP access to specific authorized users only; enable full audit logging on all data access, creation, modification, and deletion events; and configure network-based intrusion detection rules to identify exploitation attempts. Within 30 days, engage Oracle support for a security patch timeline and begin planning a formal upgrade to a patched version outside the 12.2.3-12.2.15 range, evaluating alternative platforms if patch release timelines extend beyond acceptable risk windows for your organization.

Telesales EUVD-2026-47108

| CVE-2026-60793 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-8p85-3547-4hgf

Authentication Bypass Oracle Telesales

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:09 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle TeleSales product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle TeleSales. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle TeleSales accessible data as well as unauthorized access to critical data or complete access to all Oracle TeleSales accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthorized data compromise in Oracle TeleSales (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged attacker with HTTP network access read, create, delete, or modify all TeleSales-accessible data. The flaw is rated CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, and is tagged as an authentication-bypass-class issue. No public exploit identified at time of analysis and it is not listed in CISA KEV.