What is the CVSS score of EUVD-2026-47223?

EUVD-2026-47223 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Scripting are affected by EUVD-2026-47223?

Oracle E-Business Suite versions 12.2.3-12.2.15 contain CVE-2026-60979, which allows unauthenticated remote attackers to gain complete control of the Scripting module over HTTP, potentially…

How to fix or mitigate EUVD-2026-47223?

Within 24 hours, inventory all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15 and document their network accessibility, including exposure from untrusted networks and the internet. Within 7 days, implement firewall rules to restrict HTTP access to the Scripting module exclusively to administratively controlled networks, and assess operational feasibility of disabling the Scripting module pending patch availability. Within 30 days, establish an upgrade timeline to Oracle E-Business Suite 12.2.16 or later once patches are released, and configure monitoring of Oracle security advisories to track patch status for CVE-2026-60979.

Oracle Scripting EUVD-2026-47223

| CVE-2026-60979 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-pjcm-7mv5-f9w6

Authentication Bypass Oracle Scripting

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

HTTP-reachable and pre-auth (AV:N/PR:N/UI:N); AC:H reflects the vendor's 'difficult to exploit' framing; 'takeover' justifies C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:20 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in takeover of Oracle Scripting. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Scripting, the scripted-interaction module of Oracle E-Business Suite (Internal Operations component), is possible by a remote unauthenticated attacker over HTTP in supported releases 12.2.3 through 12.2.15. Because the CVSS vector carries high confidentiality, integrity, and availability impact (8.1), a successful attack yields complete compromise of the module rather than mere data exposure, though the high attack complexity (AC:H) means exploitation is not trivial. There is no public exploit identified at time of analysis and the flaw is not on the CISA KEV list.

Technical ContextAI

Oracle Scripting is a component of Oracle E-Business Suite (EBS), Oracle's on-premise ERP/CRM stack, used to build and run guided call-center and agent interaction scripts; it is exposed through the EBS web tier over HTTP. The affected surface is the 'Internal Operations' component of the 12.2.x EBS release train, which runs on the Oracle Application Server / WebLogic middleware over a backing Oracle Database. No CWE was assigned by the vendor, so the precise root-cause class is not published; the Oracle-supplied 'Information Disclosure' tag understates the disclosed impact, since the CVSS vector asserts full C/I/A compromise ('takeover'), pointing toward an authentication/authorization bypass or injection reachable pre-auth rather than a pure read primitive.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); patch available per vendor advisory, though no discrete fix version string was published in the available data, so consult the CPU patch matrix for the exact patch number matching your 12.2.x level. Oracle CPUs are cumulative, so install the latest EBS 12.2 CPU rather than an isolated hotfix. Because the vector is network/HTTP and pre-auth, until patching completes restrict external and untrusted-network reachability of the Oracle Scripting URLs - front them behind a VPN or IP allowlist and use the Oracle EBS URL Firewall / DMZ configuration to expose only the specific responsibilities and modules required; de-registering or disabling the Scripting module if it is unused removes the surface entirely. Trade-off: URL Firewall and network restrictions can break legitimate remote agent/call-center access and must be scoped against your allowed servlet list, so test before enforcing.