What is the CVSS score of EUVD-2026-47194?

EUVD-2026-47194 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Public Sector Financials EUVD-2026-47194

| CVE-2026-60929 LOW

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-4rqr-p45c-whv5

Authentication Bypass Oracle Public Sector Financials

3.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

3.1 LOW

Network HTTP access with low privileges required; high complexity reflects unexplained prerequisite conditions; integrity-only limited impact and unchanged scope match the vendor description exactly.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:38 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Financials. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Public Sector Financials accessible data. CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N).

AnalysisAI

Unauthorized data manipulation in Oracle Public Sector Financials (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged authenticated attacker over HTTP targeting the Internal Operations component. Despite the 'Authentication Bypass' tag, the CVSS PR:L metric confirms initial credentials are required, suggesting the flaw represents a post-authentication authorization control bypass rather than a full authentication bypass. Impact is constrained to limited integrity loss - partial unauthorized insert, update, or delete of accessible data - with no confidentiality or availability impact, and no public exploit or active exploitation identified at time of analysis.

Technical ContextAI

Oracle Public Sector Financials is a specialized module within Oracle E-Business Suite (EBS), an enterprise ERP platform widely used by government and public sector entities for financial management. The affected component, Internal Operations, handles backend processing logic within the financials module and is exposed over HTTP. No CWE was assigned by the reporter, but the combination of the 'Authentication Bypass' tag and the CVSS vector (PR:L, AC:H) is most consistent with CWE-863 (Incorrect Authorization) or CWE-284 (Improper Access Control) - a condition where an authenticated low-privileged user can reach data or functions beyond their authorized scope. The high attack complexity (AC:H) implies the exploitation path requires specific application state, timing, or non-default conditions rather than a straightforward request. No CPE strings were supplied in the input data, so exact component versioning beyond the vendor-stated 12.2.3-12.2.15 range cannot be independently pinpointed.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update patches for Oracle E-Business Suite, which address this vulnerability as per the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html. No independently confirmed exact patched version number was present in the input data beyond the CPU reference - consult Oracle Support (My Oracle Support) for the specific patch identifiers applicable to your E-Business Suite release. As a compensating control prior to patching, restrict HTTP access to Oracle E-Business Suite Internal Operations endpoints to known trusted networks and VPN-only access, reducing the attacker's reachable attack surface. Review and tighten Role-Based Access Controls within EBS to ensure low-privileged accounts have the minimum necessary entitlements in the financials module, which limits the blast radius of any successful exploitation. The inherent AC:H complexity of the vulnerability also naturally reduces exploitation likelihood in the interim.