What is the CVSS score of EUVD-2026-47124?

EUVD-2026-47124 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Oracle iStore EUVD-2026-47124

| CVE-2026-60816 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-p475-vcx2-3xjw

Authentication Bypass Oracle Istore

5.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network vector confirmed via HTTP; AC:H per Oracle's 'difficult to exploit' characterization; PR:L as low-privileged authentication is required; no integrity or availability impact described.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:46 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iStore. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iStore accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized read access to critical data is possible in Oracle iStore (E-Business Suite Shopping Cart component, versions 12.2.3-12.2.15) via an authentication bypass condition exploitable by low-privileged network attackers over HTTP. The attack is rated difficult to exploit (AC:H), limiting opportunistic risk, but a successful attempt yields high confidentiality impact - complete access to all iStore-accessible data. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by Oracle via their July 2026 Critical Patch Update.

Technical ContextAI

Oracle iStore is an e-commerce self-service component of Oracle E-Business Suite (EBS), a comprehensive enterprise ERP platform. The vulnerable component is the Shopping Cart, which handles customer session data, order state, and product catalog interactions over HTTP. The tag 'Authentication Bypass' indicates the root cause is an access control or authorization enforcement failure - likely improper enforcement of session or privilege boundaries within the cart component, allowing a low-privileged authenticated user to cross authorization boundaries and read data they should not have access to. No CWE was assigned in NVD, but the bypass tag aligns with CWE-284 (Improper Access Control) or CWE-863 (Incorrect Authorization). Affected versions span a broad range: EBS iStore 12.2.3 through 12.2.15.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpujul2026.html, which contains the fix for CVE-2026-60816. An exact patched version number was not independently confirmed beyond the CPU advisory reference - consult Oracle Support and My Oracle Support (MOS) for the specific patch ID applicable to your EBS 12.2.x release. As a compensating control prior to patching, restrict network access to Oracle iStore's HTTP endpoints to trusted user segments only, reducing the pool of low-privileged users who could attempt exploitation. Additionally, review iStore Shopping Cart access logs for anomalous cross-user data access patterns. Note that restricting network access may impact legitimate customer-facing iStore usage if deployed externally - weigh this trade-off against patch urgency.