What is the CVSS score of EUVD-2026-47225?

EUVD-2026-47225 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by EUVD-2026-47225?

Oracle E-Business Suite versions 12.2.3-12.2.15 are vulnerable to data tampering via an authenticated network vector (CVE-2026-60984, CVSS 7.1), allowing low-privileged users to create, delete, and…

How to fix or mitigate EUVD-2026-47225?

Within 24 hours, inventory all Oracle E-Business Suite instances and identify systems running versions 12.2.3-12.2.15; restrict network access to the application to authorized personnel and enable detailed HTTP request logging at the firewall and application level. Within 7 days, review and minimize low-privileged account permissions to reduce surface area, implement alerting on data modification activities against critical business tables, and establish a baseline export of sensitive data for integrity verification. Within 30 days, configure automated monitoring of Oracle Critical Patch Updates; schedule a maintenance window to deploy the patch immediately upon Oracle's release to apply the vendor fix to all affected systems.

Oracle E-Business Suite EUVD-2026-47225

| CVE-2026-60984 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-q35q-33ff-j4rh

Authentication Bypass Oracle Project Portfolio Analysis

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

vuln.today AI

7.1 HIGH

Network HTTP reachability (AV:N) and easy exploitation (AC:L) with a required low-privilege account (PR:L); weighted to high integrity impact (I:H), limited read (C:L), no availability effect (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:19 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Portfolio Analysis accessible data as well as unauthorized read access to a subset of Oracle Project Portfolio Analysis accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).

AnalysisAI

Data tampering in the Oracle Project Portfolio Analysis module of Oracle E-Business Suite (Internal Operations component, versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker create, delete, or modify critical application data and read a subset of accessible data over HTTP. Oracle rates it 7.1 (CVSS 3.1) and describes it as easily exploitable, though impact is confined to data integrity and limited confidentiality with no availability effect. No public exploit identified at time of analysis; it was disclosed in the Oracle Critical Patch Update of July 2026.

Technical ContextAI

Oracle Project Portfolio Analysis is a project-management and investment-planning module within the Oracle E-Business Suite (EBS) ERP platform, here specifically the Internal Operations component. EBS is a web-tier Java/PL-SQL enterprise application accessed over HTTP, so the flaw is reachable through the standard application front end by any account holding a valid low-privilege session. Oracle did not assign a CWE (CWE: N/A) and published no technical root-cause detail; the intelligence tag 'Authentication Bypass' hints at broken access control or authorization enforcement, but this is unconfirmed and partially conflicts with the CVSS PR:L metric, which requires the attacker to already be authenticated. The high integrity impact (I:H) with only low confidentiality (C:L) suggests the defect exposes write/modify operations on records the attacker's role should not be able to alter.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships EBS security fixes as cumulative CPU patches for the 12.2.x line rather than a single named version, so identify and apply the current CPU patch level for your 12.2.3-12.2.15 deployment - no exact fix version string was provided in the input, so confirm the precise patch number in the CPU matrix. Until patched, reduce exposure by restricting network reachability of the Project Portfolio Analysis / Internal Operations functions to trusted internal networks or VPN (trade-off: may block legitimate remote users), tightening role and responsibility assignments so that low-privilege accounts cannot reach the affected pages (trade-off: requires review of EBS responsibilities and may disrupt workflows), and increasing audit logging on data-modification actions in this module to detect abuse. Because exploitation requires an authenticated low-privilege account, enforcing least privilege and reviewing dormant/over-provisioned accounts is an effective compensating control.