What is the CVSS score of CVE-2026-61006?

CVE-2026-61006 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-61006?

A vulnerability in Oracle E-Business Suite's Process Manufacturing Logistics module can be exploited by high-privileged, authenticated users to completely compromise the system and access sensitive…

How to fix or mitigate CVE-2026-61006?

Within 24 hours, conduct a complete inventory of Oracle E-Business Suite instances running Process Manufacturing Logistics and document all high-privileged user accounts with module access; implement firewall rules to restrict network access to this component and enforce multi-factor authentication for high-privileged users. Within 7 days, deploy comprehensive HTTP request logging and real-time alerting for suspicious activity against the module, conduct a formal access review to identify and remove unnecessary privileges, and assess whether additional network isolation can be implemented. Within 30 days, establish a tracking protocol with Oracle Support for patch release status and prepare a phased patching plan once available, while maintaining all interim mitigations until the patch is deployed and validated.

Oracle E-Business Suite CVE-2026-61006

EUVD-2026-47236 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-9m7f-jxjv-h6r8

Oracle Privilege Escalation E Business Suite

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network HTTP reachable (AV:N) with low complexity (AC:L) but requires an elevated EBS account (PR:H), no user interaction, unchanged scope, and full CIA loss on the module.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:13 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Process Manufacturing Logistics product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Logistics. Successful attacks of this vulnerability can result in takeover of Oracle Process Manufacturing Logistics. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Process Manufacturing Logistics (Internal Operations component of Oracle E-Business Suite) is possible for a high-privileged, authenticated attacker sending crafted HTTP requests, per Oracle's July 2026 Critical Patch Update. Successful attacks yield complete takeover of the module with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Oracle Process Manufacturing (OPM) Logistics is an ERP module within Oracle E-Business Suite (EBS) 12.2, a large Java/PL-SQL enterprise application stack fronted by Oracle Application Server / WebLogic and accessed over HTTP(S). The affected 'Internal Operations' component handles process-manufacturing logistics functions. Oracle's advisory does not disclose a CWE (CWE: N/A) or the specific defect class; the 'Information Disclosure' tag plus the C:H/I:H/A:H vector and 'takeover' language indicate the flaw lets an authorized application user escalate their reach beyond intended boundaries within the module. Exact affected CPE strings were not provided in the intelligence; affected coverage is expressed as EBS release 12.2.3 through 12.2.15.

RemediationAI

Apply the fix delivered in Oracle's July 2026 Critical Patch Update; patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html (an exact patched EBS 12.2.x point/patchset version was not provided in the intelligence and should be taken from the CPU matrix for your release). Because exploitation requires a high-privileged application account, compensating controls until patching include tightening EBS responsibility and role assignments to minimize accounts with elevated OPM Logistics / Internal Operations privileges, auditing and reducing the population of privileged users, and restricting network access to the EBS HTTP endpoints to trusted management and user networks (side effect: may block legitimate remote users and integrations, so validate access paths first). Enable and monitor application and web-tier access logs for anomalous activity by privileged accounts. Do not treat these controls as a substitute for the CPU patch.