What is the CVSS score of EUVD-2026-47182?

EUVD-2026-47182 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Oracle Property Manager EUVD-2026-47182

| CVE-2026-60912 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-fvj4-8wvg-q3x3

Authentication Bypass Oracle Property Manager

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-reachable via HTTP with low complexity; PR:L reflects required authenticated EBS session; no availability impact per description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:39 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Property Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Property Manager. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Property Manager accessible data as well as unauthorized read access to a subset of Oracle Property Manager accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Unauthorized data access in Oracle Property Manager (E-Business Suite component: Internal Operations) allows low-privileged authenticated network attackers to read and manipulate property management data via HTTP. Affected versions span 12.2.3 through 12.2.15. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the low attack complexity and broad version range make patching a near-term priority for EBS deployments.

Technical ContextAI

Oracle Property Manager is a module within Oracle E-Business Suite (EBS) that manages real estate leases, spaces, and properties for enterprise clients. The vulnerability resides in the Internal Operations component, accessible over HTTP, suggesting an application-layer access control flaw. No CWE is formally assigned, but the 'Authentication Bypass' tag indicates an improper authorization control rather than a classic authentication mechanism failure - the attacker already holds a low-privileged session (PR:L per CVSS) and abuses the Internal Operations interface to exceed their authorized access, reaching data they should not be able to read, insert, update, or delete. Affected CPE range covers Oracle EBS Property Manager versions 12.2.3 through 12.2.15 as reported by both NVD and EUVD (EUVD-2026-47182).

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not disclose exact patched sub-release numbers in the advisory summary; customers should consult My Oracle Support for the specific patch bundle applicable to their 12.2.x release. Until the patch is applied, restrict network access to Oracle E-Business Suite Internal Operations endpoints at the network layer - limit HTTP access to the EBS application tier from trusted subnets only and enforce role-based access controls to ensure only required users hold any privileges in Oracle Property Manager. Disabling or restricting the Internal Operations component functionality for users who do not require it reduces the attack surface. Note that network-layer controls alone do not eliminate the vulnerability if attackers already hold valid low-privilege EBS accounts.