What is the CVSS score of EUVD-2026-47198?

EUVD-2026-47198 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.3%.

Oracle Labor Distribution EUVD-2026-47198

| CVE-2026-60936 LOW

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 secalert_us@oracle.com

GHSA-x9cc-9qmg-m6m2

Denial Of Service Oracle E Business Suite

3.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

3.1 LOW

Network delivery confirmed via HTTP, but AC:H reflects Oracle's 'difficult to exploit' designation; PR:L required per description; only partial availability impact, no confidentiality or integrity effect.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:37 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Labor Distribution. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Labor Distribution. CVSS 3.1 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L).

AnalysisAI

Partial denial-of-service in Oracle Labor Distribution (E-Business Suite versions 12.2.3 through 12.2.15) is exploitable by low-privileged authenticated attackers over HTTP under high-complexity conditions. The vulnerability affects only the availability of the Internal Operations component and yields only a partial availability impact, placing it firmly in the low-severity tier. No public exploit code exists and no active exploitation has been identified at the time of analysis.

Technical ContextAI

Oracle Labor Distribution is a module within Oracle E-Business Suite (EBS) used primarily by large organizations - universities, government contractors, and healthcare entities - to allocate and distribute employee labor costs across projects or cost centers. The affected component is 'Internal Operations,' suggesting the flaw resides in a server-side processing routine accessible via HTTP. No CWE identifier was assigned by NVD or Oracle, so the root-cause class (e.g., input validation failure, resource exhaustion) cannot be confirmed from available data. The CVSS vector AV:N/AC:H indicates the attack is network-reachable but requires the attacker to satisfy difficult pre-conditions, likely a specific operational state or race condition within the EBS application layer.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, referenced at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPUs are cumulative, so organizations already current on prior CPUs need only apply the July 2026 update. No exact fixed build or patch number was published in the available data - patch availability is confirmed per vendor advisory but the specific remediated version is not independently confirmed from this intelligence. If immediate patching is not feasible, restrict access to the Oracle EBS Internal Operations component to only those users and network segments that operationally require it, minimizing exposure to low-privileged accounts that could satisfy the PR:L requirement. Note that this workaround does not eliminate the vulnerability and carries the trade-off of potentially disrupting legitimate Labor Distribution workflows.