What is the CVSS score of CVE-2026-61005?

CVE-2026-61005 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-61005?

Oracle E-Business Suite's OPM Logistics component (versions 12.2.3-12.2.15) contains a data access vulnerability allowing any low-privileged internal user to view, modify, or delete all supply chain…

How to fix or mitigate CVE-2026-61005?

Within 24 hours, identify all systems running Oracle E-Business Suite versions 12.2.3 through 12.2.15 with OPM Logistics enabled and document current user access permissions; assess the scope of logistics data accessible through the component. Within 7 days, implement network-level access controls to restrict HTTP connectivity to OPM Logistics to only authorized systems, enable comprehensive audit logging for all component transactions, and enforce multi-factor authentication for all user access. Within 30 days, monitor Oracle's Critical Patch Updates for an available security fix; develop a deployment plan to apply patches immediately upon release, while maintaining compensating controls until updates are installed.

Oracle E-Business Suite CVE-2026-61005

EUVD-2026-47235 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-2656-6276-fpfv

Authentication Bypass Oracle E Business Suite

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reach with low complexity and a low-privilege account (PR:L per Oracle) yields high confidentiality and integrity impact but no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:14 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Process Manufacturing Logistics product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Logistics. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Process Manufacturing Logistics accessible data as well as unauthorized access to critical data or complete access to all Oracle Process Manufacturing Logistics accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Process Manufacturing (OPM) Logistics, a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows a low-privileged authenticated attacker with network access over HTTP to read, create, delete, or modify all data accessible to the OPM Logistics component. The flaw is rated CVSS 3.1 8.1 (high) with confidentiality and integrity impact but no availability impact, and was disclosed in the Oracle July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected technology is Oracle E-Business Suite (EBS), a large enterprise resource planning (ERP) suite, specifically the Process Manufacturing (OPM) Logistics module under the Internal Operations component. Oracle EBS is a web-tier (Oracle Application Server / WebLogic fronting an Oracle Database) application accessed over HTTP, which is consistent with the AV:N HTTP attack surface. Oracle publishes no CWE for this issue (CWE: N/A), but the described impact - a low-privileged user gaining broad unauthorized read and write access to all component-accessible data - is characteristic of a broken access control / missing authorization class of weakness (CWE-862/CWE-863); the third-party 'Authentication Bypass' tag points in the same direction, though it conflicts with the CVSS PR:L metric (see risk assessment). No specific CPE strings were provided beyond the EUVD version range.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026; Oracle addresses EBS 12.2.x issues through the cumulative CPU patch for the relevant 12.2 codelevel rather than a single named release, so identify and apply the July 2026 CPU patch for your EBS 12.2.3-12.2.15 environment as documented at https://www.oracle.com/security-alerts/cpujul2026.html (Patch available per vendor advisory; an exact standalone fix version is not stated in the provided data). Because exploitation requires a low-privileged HTTP session, effective compensating controls until patching include restricting network access to the EBS web tier to trusted internal networks or VPN, placing the application behind a WAF/reverse proxy that limits reachable OPM Logistics endpoints, tightening user provisioning to remove unnecessary low-privilege accounts, and increasing audit logging on OPM Logistics data access - each trades some administrative overhead or user convenience for reduced exposure but none substitutes for the CPU patch.