What is the CVSS score of EUVD-2026-47150?

EUVD-2026-47150 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Quality are affected by EUVD-2026-47150?

Oracle E-Business Suite Quality module (versions 12.2.3-12.2.15) contains a flaw enabling authenticated users to achieve full compromise of quality assurance operations, affecting data integrity and…

How to fix or mitigate EUVD-2026-47150?

Within 24 hours, inventory all Oracle E-Business Suite deployments running Quality module versions 12.2.3-12.2.15 and immediately restrict module access to system administrators only, removing all low-privilege user access. Within 7 days, implement mandatory network-level controls requiring VPN or IP whitelisting for Quality module access, enable multi-factor authentication for Quality sessions, and conduct an access audit to remove residual low-privilege grants. Within 30 days, monitor Oracle Security Alerts for vendor patch releases and schedule upgrade to Quality module version 12.2.16 or later immediately upon release; if no patch is available within 90 days, begin evaluating alternative quality management systems.

Quality EUVD-2026-47150

| CVE-2026-60855 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-wp5h-9cwp-2jpf

Privilege Escalation Oracle Quality

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:44 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Quality. Successful attacks of this vulnerability can result in takeover of Oracle Quality. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of the Oracle Quality module within Oracle E-Business Suite (Internal Operations component, versions 12.2.3 through 12.2.15) is possible for a low-privileged, authenticated attacker reaching the application over HTTP. Successful attacks lead to complete takeover of Oracle Quality with high confidentiality, integrity, and availability impact, though Oracle rates the attack complexity as high. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.