What is the CVSS score of EUVD-2026-47193?

EUVD-2026-47193 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate EUVD-2026-47193?

Within 24 hours, identify all systems running Oracle E-Business Suite versions 12.2.3 through 12.2.15 and verify which instances have the Public Sector Financials module enabled; prioritize systems with public network exposure or high-risk user populations. Within 7 days, apply the July 2026 Critical Patch Update from Oracle to all affected systems; coordinate with financial and operations teams to schedule patching during low-risk windows and verify module functionality post-patch. Within 30 days, complete patching across all affected EBS instances, conduct user access reviews to ensure low-privileged accounts have appropriate restrictions to financial transaction capabilities, and validate transaction logs for any suspicious activity during the exposure window.

Oracle E-Business Suite EUVD-2026-47193

| CVE-2026-60927 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-vvw9-ch49-r4p9

Privilege Escalation Oracle Public Sector Financials

7.5

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain low-privileged EBS credentials
Delivery

Reach Internal Operations over HTTP
Exploit

Send crafted request meeting AC:H conditions
Execution

Exploit Public Sector Financials flaw
Impact

Take over module (read/modify financial data)

Vulnerability Assessment

Weakness	CWE CWE-269 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Least privilege enforcement MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires a valid low-privileged Oracle E-Business Suite account (CVSS PR:L - authenticated), network access to the EBS web tier over HTTP (AV:N), and reaching the Internal Operations component of the Public Sector Financials module; no end-user interaction is needed (UI:N). Limiting factors: the affected deployment must be running EBS 12.2.3-12.2.15 with the Public Sector Financials module installed and network-reachable, and Oracle rates the vulnerability as difficult to exploit (AC:H), implying additional non-default preconditions, timing, or configuration/state that the attacker must satisfy or win a race against - this materially reduces reliable, at-will exploitation despite the network vector.
Impact	Signals are mixed and lean toward moderate, not emergency, priority. CVSS 3.1 is 7.5 (High) but the vector's AC:H (high attack complexity) plus PR:L (requires a valid low-privileged account) meaningfully raise the bar versus an unauthenticated internet-facing RCE. There is no EPSS score provided, no POC, and no CISA KEV listing, so no evidence of active or imminent exploitation. Weighing against that: EBS is a high-value target frequently exposed to internal and sometimes external users, and Oracle rates the impact as full takeover of the module. Applying an SSVC-style read: exploitation status is 'none' (no observed exploitation or public PoC), technical impact is 'total' (takeover), but automatability is likely 'no' given AC:H and the authentication requirement - supporting a scheduled-patch rather than out-of-cycle response. No conflicting data was detected between the description and the CVSS vector; both agree on network HTTP access with low privileges and difficult exploitation.
Exploit ScenarioDerived	An attacker who holds or phishes a low-privileged EBS application account authenticates to the E-Business Suite web tier and sends specially crafted HTTP requests to the Internal Operations component of Public Sector Financials. By exploiting the flaw (which requires overcoming non-trivial conditions given AC:H), they escalate to full takeover of the Public Sector Financials module, reading and altering financial data. No public exploit code is identified at time of analysis, so an attacker would need to develop the exploit independently.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Full compromise (takeover) of the Oracle Public Sector Financials module in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible by a low-privileged, authenticated attacker sending crafted HTTP requests to the Internal Operations component. The flaw carries a CVSS 3.1 base score of 7.5 and impacts confidentiality, integrity, and availability, but is rated hard to exploit (AC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; Oracle addressed it in the July 2026 Critical Patch Update.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); this is Patch available per vendor advisory - Oracle CPUs ship as cumulative patch sets rather than a single tagged product version, so consult the CPU patch availability matrix for the exact EBS 12.2 patch corresponding to your release level. As compensating controls until patching, restrict network reach to the EBS web tier by placing it behind VPN/segmentation and limiting HTTP access to the Internal Operations/Public Sector Financials functions to trusted users, tighten and audit low-privileged application accounts (the attack requires valid credentials), and put a WAF or reverse proxy in front of the OA Framework endpoints to inspect and rate-limit requests; note the trade-off that aggressive filtering or URL restrictions on EBS can break legitimate application flows and should be validated in a test environment first. Because Oracle CPU patches are cumulative, applying the July 2026 CPU also remediates prior EBS issues.

Affected VersionsENISA

Oracle Public Sector Financials 12.2.3 ≤12.2.15

Affected Packages

euvd oracle_public_sector_financials no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle E-Business Suite (EBS) is Oracle's integrated enterprise resource planning (ERP) suite; Public Sector Financials is the government/public-sector financial management module, and the affected surface is the Internal Operations component reached over HTTP through the EBS web tier (typically Oracle Application Server / WebLogic fronting the E-Business Suite forms and OA Framework pages). Oracle does not publish a specific CWE for this issue (CWE: N/A) and the advisory withholds root-cause detail per Oracle's standard CPU disclosure practice, but the combination of network HTTP vector, low-privilege requirement, and full C/I/A takeover is consistent with an authenticated web-tier flaw (for example an injection or access-control weakness) in an authenticated application function. The Oracle-supplied tag 'Information Disclosure' hints at a confidentiality-relevant primitive, though the vector shows equal Integrity and Availability impact consistent with the described full takeover.

Know when Public Sector Financials gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 7.5 HIGH

Authenticated low-priv user (PR:L) over HTTP (AV:N) with non-trivial preconditions (AC:H) achieving full module takeover justifies C:H/I:H/A:H and unchanged scope.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Financials. Successful attacks of this vulnerability can result in takeover of Oracle Public Sector Financials. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive ViewAI

Why It Matters

CVE-2026-60927 affects Oracle E-Business Suite versions 12.2.3 through 12.2.15 with the Public Sector Financials module deployed, enabling authenticated low-privilege users to achieve complete system compromise including full access to financial data and system controls. Organizations operating these EBS versions face immediate risk to financial data integrity, regulatory compliance, and operational continuity if the module is accessible to internal or contractor users.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.4%

Top 70% exploitable

Prevalence

Medium

Widely used enterprise ERP, but public-sector financials is a niche module

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.