What is the CVSS score of EUVD-2026-47141?

EUVD-2026-47141 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Knowledge Management EUVD-2026-47141

| CVE-2026-60842 MEDIUM

Improper Authorization (CWE-285)

2026-07-21 secalert_us@oracle.com

GHSA-j72j-2hvh-wrmg

Authentication Bypass Oracle Knowledge Management

6.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-accessible unauthenticated attack requiring victim interaction, scope change to adjacent EBS products, limited read/write impact, no availability impact - consistent with vendor vector.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:44 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Search). Supported versions that are affected are 12.2.5-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Knowledge Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Knowledge Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Knowledge Management accessible data as well as unauthorized read access to a subset of Oracle Knowledge Management accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

AnalysisAI

The Search component of Oracle Knowledge Management in E-Business Suite versions 12.2.5 through 12.2.15 allows unauthenticated network attackers to compromise data confidentiality and integrity when a victim user interacts with a crafted HTTP request, with successful exploitation producing a scope change that can impact additional E-Business Suite products. Disclosed via Oracle's July 2026 Critical Patch Update, the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) scores 6.1 and is consistent with a reflected injection class - likely Cross-Site Scripting - given the combination of no-privilege network access, required human interaction, and cross-product scope change. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Oracle Knowledge Management is a self-service knowledge base module within Oracle E-Business Suite (OES), providing search and content retrieval capabilities over HTTP. The vulnerability resides in the Search component and, based on the CVSS vector pattern (PR:N, UI:R, S:C, C:L, I:L, A:N), is consistent with a client-side injection class such as reflected or stored Cross-Site Scripting - no CWE is formally assigned in the source data, so this classification is inferred. The scope change (S:C) indicates the exploit can affect E-Business Suite products beyond Knowledge Management itself, likely by leveraging a shared browser session or cross-application resource inclusion. The 'Authentication Bypass' intelligence tag may indicate the Search endpoint is accessible without authentication while exposing data or functionality that should be restricted. Affected product range per ENISA EUVD entry EUVD-2026-47141: Oracle Knowledge Management versions 12.2.5 through 12.2.15. No CPE strings were present in the source data; defenders should consult the Oracle July 2026 CPU for authoritative CPE identifiers.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, which addresses this vulnerability across the affected version range (12.2.5-12.2.15); the advisory is available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPU patches are cumulative, so applying the July 2026 CPU addresses this and all prior unpatched vulnerabilities - the specific patched release version was not independently confirmed in the available source data, so consult the CPU advisory for exact versioning. If immediate patching is not possible, restrict network access to the Knowledge Management Search component via firewall rules or reverse proxy access controls to limit exposure to internal trusted networks; note this disrupts self-service knowledge base access for external or remote users. Additionally, enforce a Content Security Policy (CSP) header on the E-Business Suite web tier (e.g., default-src 'self') to limit the blast radius of any injected script execution; this is a compensating control only and does not eliminate the underlying vulnerability.