What is the CVSS score of EUVD-2026-47205?

EUVD-2026-47205 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Service Fulfillment Manager are affected by EUVD-2026-47205?

Oracle Service Fulfillment Manager in E-Business Suite versions 12.2.3 through 12.2.15 contains an authenticated privilege escalation vulnerability (CVSS 7.5) permitting low-privileged users to…

How to fix or mitigate EUVD-2026-47205?

Within 24 hours, identify all E-Business Suite systems running affected versions 12.2.3 through 12.2.15 and confirm current patch status. Within 7 days, deploy Oracle's July 2026 Critical Patch Update to all in-scope systems; if deployment requires change control delays, implement compensating controls immediately by restricting HTTP network access to the Fulfillment Engine component to administrative accounts only. Within 30 days, complete patch verification across all systems, conduct end-to-end testing of fulfillment workflows, and review audit logs for unauthorized access attempts during the remediation window.

Oracle Service Fulfillment Manager EUVD-2026-47205

| CVE-2026-60943 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-h5fm-hxg3-8hhj

Privilege Escalation Oracle Service Fulfillment Manager

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network HTTP reachable (AV:N) but needs a valid low-privileged EBS account (PR:L) and non-trivial preconditions (AC:H); takeover yields full C/I/A within an unchanged scope.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:28 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Service Fulfillment Manager product of Oracle E-Business Suite (component: Fulfillment Engine). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Fulfillment Manager. Successful attacks of this vulnerability can result in takeover of Oracle Service Fulfillment Manager. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Service Fulfillment Manager (a Fulfillment Engine component of Oracle E-Business Suite 12.2.3 through 12.2.15) is possible where an authenticated, low-privileged attacker with network HTTP access can escalate to complete takeover of the module. Although rated CVSS 3.1 7.5 with confidentiality, integrity and availability impact, the attack complexity is high, meaning exploitation is non-trivial. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Service Fulfillment Manager is an order-and-service fulfillment orchestration module within the Oracle E-Business Suite (EBS) 12.2 family, exposed over HTTP through the EBS web tier. The affected code lies in the Fulfillment Engine component, which processes fulfillment workflow requests. No CWE was assigned by the source, so the precise root-cause class (e.g., injection, broken access control, or deserialization) cannot be stated with certainty; Oracle's own 'Information Disclosure' tag combined with full C/I/A impact suggests a flaw that both leaks data and permits state manipulation leading to module takeover. Because EBS 12.2 runs on a WebLogic/Oracle Application Server middle tier, the HTTP attack surface is the standard EBS servlet/JSP interface reachable by authenticated application users.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html), which is the primary vendor-supported remediation for all affected EBS 12.2.3-12.2.15 deployments; an exact fixed sub-version is not enumerated in the available data, so consult the CPU patch matrix for the specific patch number for your release. Because the flaw requires an authenticated low-privileged account and network HTTP access, effective interim compensating controls are: restrict network reachability of the Service Fulfillment Manager / Fulfillment Engine URLs to trusted management networks or place them behind VPN (side effect: may break legitimate remote fulfillment users), tighten EBS user provisioning by removing unneeded low-privilege accounts and responsibilities that grant access to the fulfillment module (side effect: administrative overhead and possible workflow disruption), and increase monitoring of EBS application and access logs for anomalous fulfillment-engine requests. These are mitigations only and do not eliminate the flaw.