What is the CVSS score of EUVD-2026-47153?

EUVD-2026-47153 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Oracle Order Management EUVD-2026-47153

| CVE-2026-60862 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-38fx-jhqr-hrg9

Authentication Bypass Oracle Order Management

6.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.8 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.8 MEDIUM

Network-accessible HTTP vector with no user interaction, but PR:H required; scope change reflects diagnostic tool access crossing module boundaries; confidentiality-only impact confirmed.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:43 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Order Management. While the vulnerability is in Oracle Order Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Order Management accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized critical data disclosure in Oracle Order Management (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 stems from a flaw in the Product Diagnostic Tools component, exploitable by a high-privileged attacker over HTTP with no user interaction. Successful exploitation triggers a scope change, meaning the compromise can extend to additional Oracle products accessible through the Order Management context, resulting in complete access to all confidential data within that reach. No public exploit has been identified at time of analysis, and a fix is available via Oracle's Critical Patch Update for July 2026.

Technical ContextAI

Oracle E-Business Suite (EBS) is Oracle's integrated enterprise resource planning platform, and Order Management is one of its core transaction-processing modules. The affected component, Product Diagnostic Tools, is an internal diagnostics and troubleshooting interface embedded within the module. Such components frequently operate with elevated internal permissions to gather cross-system data, making them a high-value target for privilege escalation and unauthorized data access. The CVSS vector's Scope:Changed (S:C) flag indicates that successful exploitation crosses a security authorization boundary, allowing the attacker to impact resources beyond the Order Management component itself - consistent with diagnostic tooling that can inspect or export data from adjacent EBS modules. No CWE is assigned in the NVD record, but the 'Authentication Bypass' tag from multi-source intelligence suggests the root cause is an authorization control failure (bypassing internal access controls within an authenticated session) rather than a lack of authentication at the network boundary. This is consistent with the PR:H metric, which confirms a pre-existing high-privilege session is required.

RemediationAI

Apply the patch provided in Oracle's Critical Patch Update for July 2026, available through the Oracle Support portal and referenced at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPU patches are cumulative and should be applied to all affected EBS 12.2.3-12.2.15 installations. An exact standalone fix version beyond the CPU release is not independently confirmed from the available data, so follow Oracle's patch application instructions from the advisory directly. As a compensating control pending patching, restrict network access to the Product Diagnostic Tools component at the application or network layer - for example, by limiting access to the relevant EBS URLs or menu functions to a minimal set of trusted administrator accounts, thereby reducing the attacker pool given the PR:H requirement. Review and audit which accounts hold high-privileged roles in Order Management and enforce least-privilege principles; this limits the blast radius if a high-privileged account is compromised. No workarounds that fully mitigate the vulnerability without patching have been identified from available data.