What is the CVSS score of CVE-2026-61004?

CVE-2026-61004 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of E Business Suite are affected by CVE-2026-61004?

Oracle Landed Cost Management (CVE-2026-61004) enables low-privileged authenticated users to read, modify, and delete cost and supply chain data across EBS releases 12.2.3-12.2.15, undermining…

How to fix or mitigate CVE-2026-61004?

Within 24 hours, identify all Oracle E-Business Suite systems running Landed Cost Management on releases 12.2.3 through 12.2.15, document business criticality and data sensitivity, and restrict network access to this module to essential personnel only. Within 7 days, implement additional application-layer authentication or IP-based access controls, enable comprehensive audit logging for all data access and modifications, and establish daily review procedures for suspicious activity. Within 30 days, deploy the Oracle Critical Patch Update immediately upon availability, and conduct a comprehensive audit of Landed Cost Management access logs to identify and remediate any unauthorized data modifications since the vulnerability's public disclosure.

E Business Suite CVE-2026-61004

EUVD-2026-47234 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-3hww-86rv-hwqw

Authentication Bypass Oracle E Business Suite

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:14 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Landed Cost Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Landed Cost Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Landed Cost Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Landed Cost Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Landed Cost Management (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-based attacker over HTTP to read, create, delete, or modify all data accessible to the module across supported releases 12.2.3 through 12.2.15. The flaw carries CVSS 8.1 with high confidentiality and integrity impact but no availability impact, and is remediated in the Oracle Critical Patch Update of July 2026. No public exploit identified at time of analysis and it is not listed in CISA KEV.