What is the CVSS score of EUVD-2026-47165?

EUVD-2026-47165 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle Work in Process EUVD-2026-47165

| CVE-2026-60888 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-xhxx-v8vm-4w4g

Authentication Bypass Information Disclosure Oracle Work In Process

5.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network HTTP access confirmed; AC:H per Oracle 'difficult to exploit'; PR:L for required low-privilege account; confidentiality-only impact with no integrity or availability effect.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:42 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Work in Process. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Work in Process accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized read access to critical data in Oracle Work in Process (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged, network-connected attacker exploiting an authentication bypass in the Internal Operations component via HTTP. The flaw is rated difficult to exploit (AC:H) and carries no integrity or availability impact, but successful exploitation grants complete access to all data accessible within the Work in Process module. No public exploit code or CISA KEV listing is associated with this vulnerability at time of analysis.

Technical ContextAI

Oracle Work in Process is a manufacturing execution and shop-floor management module within Oracle E-Business Suite (EBS), an enterprise ERP platform widely deployed in large organizations. The vulnerable component is 'Internal Operations,' accessed over HTTP, indicating a server-side application endpoint. The 'Authentication Bypass' tag is the primary technical signal: despite requiring low-privilege credentials (PR:L in CVSS), the vulnerability allows the attacker to circumvent authorization controls - likely bypassing object-level or function-level access checks - to read data the authenticated session should not be permitted to access. CWE is not specified by the reporter, but the combination of the Authentication Bypass tag and the CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) is consistent with CWE-287 (Improper Authentication) or CWE-639 (Authorization Bypass Through User-Controlled Key). The AC:H rating implies a non-trivial exploitation path, such as a race condition, specific session state, or crafted request structure that must be precisely constructed.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPU patches are cumulative for E-Business Suite 12.2.x and should be applied following Oracle's standard patching procedures. An exact patched release version was not independently confirmed beyond the advisory reference - verify the specific patch number against the July 2026 CPU documentation for Oracle Work in Process. As a compensating control prior to patching, restrict network access to the Oracle EBS application tier so that only authorized internal network segments can reach HTTP endpoints; this does not eliminate the vulnerability but raises the attacker's access prerequisites. If the Internal Operations component can be disabled or access-controlled at the application level via EBS function security menus without operational impact, restricting it to administrative roles only provides additional defense while patching is staged. Note that restricting network access may affect legitimate remote EBS users and should be coordinated with operations teams.