What is the CVSS score of EUVD-2026-47204?

EUVD-2026-47204 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

How to fix or mitigate EUVD-2026-47204?

Within 24 hours, identify all Oracle E-Business Suite instances in production running versions 12.2.3 through 12.2.15 and classify exposure scope by environment and user base; document which systems process live fulfillment orders. Within 7 days, implement network-level access restrictions limiting Fulfillment Manager module connectivity to authorized systems only, enable comprehensive audit logging of all data access and modifications within the module, and conduct forensic review of access logs for the past 90 days to identify unauthorized data access. Within 30 days, deploy database-level row-level security policies restricting low-privileged user visibility to data, establish automated integrity monitoring of fulfillment records, establish weekly reconciliation controls, and configure alerting for vendor patch release notifications.

Oracle Service Fulfillment Manager EUVD-2026-47204

| CVE-2026-60942 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-jxjj-4jfq-6px6

Authentication Bypass Oracle Service Fulfillment Manager

8.1

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate with low-privileged EBS account
Delivery

Reach Fulfillment Engine over HTTP
Exploit

Send crafted request bypassing authorization
Execution

Read or tamper with fulfillment data
Impact

Unauthorized data disclosure and modification

Vulnerability Assessment

Weakness	CWE CWE-284 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Access control enforcement MITRE ATT&CK 1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires network access to the Oracle Service Fulfillment Manager HTTP interface plus a valid low-privileged Oracle E-Business Suite account (CVSS PR:L), with no user interaction and low complexity. Exploitation is limited to EBS 12.2.3-12.2.15 deployments that have the Service Fulfillment Manager / Fulfillment Engine module provisioned and reachable. Note the vendor 'Authentication Bypass' tag suggests the required privilege level may be lower than PR:L implies - confirm against Oracle's CPU advisory whether an unauthenticated path exists before relying on the authentication requirement as a mitigating factor.
Impact	The signals are moderately strong but not maximal. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates a remote, low-complexity attack needing only low privileges and no user interaction, yielding high confidentiality and integrity impact - hence the 8.1. PR:L means the attacker must already hold some authenticated foothold (a valid low-privileged EBS account), which meaningfully limits opportunistic mass exploitation versus a PR:N flaw. No EPSS score was provided, so exploitation probability cannot be quantified. It is not listed in CISA KEV and no POC is referenced, so there is no evidence of active exploitation. The 'Authentication Bypass' tag appears to conflict with the PR:L vector (a true unauthenticated bypass would suggest PR:N); this discrepancy should be verified against Oracle's advisory before assuming pre-auth reachability. Net: a genuine high-severity priority for organizations running this EBS module, but currently a patch-promptly issue rather than a confirmed emergency.
Exploit ScenarioDerived	An attacker who has obtained or been granted a low-privileged Oracle E-Business Suite account sends crafted HTTP requests to the Service Fulfillment Manager Fulfillment Engine and, exploiting the authorization weakness, reads, alters, or deletes fulfillment data beyond their intended permissions. Because attack complexity is low and no user interaction is needed, a single valid foothold account is enough; no public POC is currently known.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Data compromise in Oracle Service Fulfillment Manager (Fulfillment Engine component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read, create, modify, or delete all data accessible to the module over HTTP. Rated CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, and Oracle labels it easily exploitable. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and Oracle's 'easily exploitable' wording make it a strong patch priority for EBS operators.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships EBS 12.2 security fixes as cumulative CPU patches rather than a single renamed version, so identify and apply the specific 12.2.x CPU patch for your installed release - patch available per vendor advisory, exact fix build not independently confirmed here. Because exploitation requires an authenticated low-privileged account, interim compensating controls include tightening EBS account provisioning and least-privilege role assignment, restricting network reachability of the Service Fulfillment Manager HTTP endpoints to trusted internal segments or VPN, and increasing monitoring/auditing of create/modify/delete activity against fulfillment data; note these controls reduce exposure but do not close the underlying authorization flaw, and network restrictions may impede legitimate integrations.

Affected VersionsENISA

Oracle Service Fulfillment Manager 12.2.3 ≤12.2.15

Affected Packages

euvd oracle_service_fulfillment_manager no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle E-Business Suite is Oracle's enterprise ERP platform, and Service Fulfillment Manager (Fulfillment Engine) is the order-orchestration/service-provisioning module within it. The affected surface is the HTTP-facing application tier of EBS 12.2.x. No CWE was assigned by NVD, so the precise root-cause class is unconfirmed; however, the supplied tags cite 'Authentication Bypass,' which together with the impact profile (full read plus create/modify/delete of module data without availability loss) is consistent with a broken-access-control or authorization-bypass weakness that lets an authenticated low-privileged user reach data and operations beyond their intended scope. Exact affected products cannot be pinned to CPE strings because none were provided; version bounds come from the Oracle description and the ENISA EUVD record.

Know when Service Fulfillment Manager gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI 8.1 HIGH

Remote HTTP reach with low complexity and no UI, but a valid low-privileged account is required (PR:L); full data read and tamper give C:H/I:H, with no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

DescriptionCVE.org

Vulnerability in the Oracle Service Fulfillment Manager product of Oracle E-Business Suite (component: Fulfillment Engine). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Fulfillment Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Service Fulfillment Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Service Fulfillment Manager accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Executive ViewAI

Why It Matters

Oracle Service Fulfillment Manager in E-Business Suite versions 12.2.3-12.2.15 allows authenticated low-privileged users to read, create, modify, or delete all fulfillment data via network access, directly compromising order integrity and business-critical records. With no vendor-released patch identified at time of analysis and Oracle designating this as easily exploitable, organizations running affected versions face material risk of order manipulation and data theft in their fulfillment operations.

Business Impact: Severe

Compensating Controls

Implement network segmentation restricting Fulfillment Manager connectivity to known business processes; enable detailed audit logging and monitoring of all data access and modifications; apply database row-level security policies limiting low-privileged account data visibility; restrict fulfillment transactions to service accounts with minimal required privileges; establish automated data integrity reconciliation and anomaly detection on fulfillment records.

Threat Intelligence Overview

EPSS Score

0.4%

Top 71% exploitable

Prevalence

Medium

specific EBS module; not enabled in every Oracle E-Business Suite deployment

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.