What is the CVSS score of EUVD-2026-47131?

EUVD-2026-47131 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Interaction Blending are affected by EUVD-2026-47131?

Oracle Interaction Blending, the telephony and campaign-routing module within Oracle E-Business Suite's Internal Operations component, is vulnerable to complete compromise by high-privilege users via…

How to fix or mitigate EUVD-2026-47131?

Within 24 hours, identify and audit all Oracle E-Business Suite instances running Interaction Blending, documenting current versions and administrative access controls; within 7 days, obtain and test the Oracle July 2026 Critical Patch Update in a pre-production environment to verify compatibility and system stability; by day 30, deploy the patch to all production instances, prioritizing those handling customer-facing telephony and campaign operations, and validate remediation through post-patch testing.

Oracle Interaction Blending EUVD-2026-47131

| CVE-2026-60828 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-9mgp-h54j-rh68

Authentication Bypass Oracle Interaction Blending

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Reachable over HTTP (AV:N) with low complexity and no interaction, but requires pre-existing high EBS privilege (PR:H); vendor describes full component takeover, so C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:55 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Interaction Blending product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Interaction Blending. Successful attacks of this vulnerability can result in takeover of Oracle Interaction Blending. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Interaction Blending, a telephony/campaign-routing module within Oracle E-Business Suite (Internal Operations component), is possible by a high-privileged attacker sending crafted HTTP requests over the network. Oracle rates successful exploitation as a complete takeover of the component with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the fix ships in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Interaction Blending is part of the Oracle E-Business Suite (EBS) contact-center stack, coordinating inbound and outbound (predictive dialing) telephony interactions; the flaw sits in its Internal Operations component and is reached over HTTP through the EBS web/middle tier. No CWE is assigned in the source data, so the precise root-cause class is unstated, though the Oracle 'Information Disclosure' tag combined with the CVSS full-CIA impact points to an authenticated web-facing flaw that escalates from a legitimately held privilege to control of the module. Affected code exists across the EBS 12.2 release train from 12.2.3 through 12.2.15, indicating a long-standing issue in the module rather than a regression in a single release.

RemediationAI

Patch available per vendor advisory: apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to all Oracle E-Business Suite 12.2.3-12.2.15 instances running Interaction Blending; no standalone fixed version number is published in the input beyond the CPU itself. As compensating controls until the CPU is applied, restrict network reachability of the EBS middle tier and the Interaction Blending endpoints to trusted administrative networks (this reduces the AV:N exposure but does not stop an authenticated insider), and tighten and audit EBS responsibilities/roles so that the high-privilege access the exploit requires (PR:H) is granted to as few accounts as possible with monitoring on those accounts (this shrinks the eligible attacker pool at the cost of administrative overhead). If the Interaction Blending module is not in active use, consider disabling it to remove the attack surface entirely, accepting the loss of blended-telephony functionality.