What is the CVSS score of EUVD-2026-47133?

EUVD-2026-47133 has a CVSS 3.1 base score of 4.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Oracle Interaction Blending EUVD-2026-47133

| CVE-2026-60832 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-3w26-cq83-2q7p

Authentication Bypass Denial Of Service Oracle Interaction Blending

4.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.1 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

4.1 MEDIUM

Network-accessible RMI requires pre-existing high privileges and difficult exploitation conditions; all CIA impacts limited to Low with no scope change.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:45 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Interaction Blending product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via RMI to compromise Oracle Interaction Blending. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Interaction Blending accessible data as well as unauthorized read access to a subset of Oracle Interaction Blending accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Interaction Blending. CVSS 3.1 Base Score 4.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Oracle Interaction Blending within E-Business Suite exposes a network-accessible RMI interface flaw that allows a high-privileged attacker to partially compromise confidentiality, integrity, and availability of application data. Affected deployments span versions 12.2.3 through 12.2.15 of the Internal Operations component. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing it at low immediate operational priority despite the triple-impact scope.

Technical ContextAI

Oracle Interaction Blending is a contact center routing and blending module within Oracle E-Business Suite (EBS), a comprehensive enterprise resource planning suite. The affected component is 'Internal Operations,' which communicates over Java RMI (Remote Method Invocation) - a Java-native protocol for remote procedure calls between JVMs. RMI endpoints, when exposed on the network, can be targeted by attackers with valid credentials to invoke privileged operations or manipulate serialized objects. The CWE is listed as N/A, so the precise root cause class (e.g., improper access control, insecure deserialization) is not confirmed by NVD. The CVSS vector AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L reflects a network-reachable but difficult-to-exploit flaw with limited blast radius - all three security properties are impacted at a Low level with no scope change.

RemediationAI

Consult the Oracle Critical Patch Update for July 2026 at https://www.oracle.com/security-alerts/cpujul2026.html to obtain the applicable patch for Oracle E-Business Suite. The advisory is the primary remediation source; an exact patched version number was not specified in the available intelligence data, so administrators should reference the CPU directly to confirm the target release. Patch status is 'Patch available per vendor advisory' - a precise fix version could not be independently confirmed from the provided references. As a compensating control pending patching, restrict network access to the RMI port used by Oracle Interaction Blending's Internal Operations component at the network perimeter or host-based firewall, limiting reachability to only necessary administrative hosts; note that this reduces but does not eliminate exposure if high-privileged credentials are already compromised. Additionally, audit high-privileged EBS account assignments and rotate credentials as a precautionary measure, since PR:H is a required exploitation precondition.