What is the CVSS score of CVE-2026-61009?

CVE-2026-61009 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-61009?

Oracle Process Manufacturing Logistics (Oracle E-Business Suite module managing supply chain operations) is vulnerable to complete system takeover by high-privileged authenticated users accessing the…

How to fix or mitigate CVE-2026-61009?

Within 24 hours, audit all Oracle EBS Process Manufacturing Logistics instances to identify high-privileged user accounts and document HTTP access paths. Within 7 days, deploy network-level controls restricting HTTP access to the vulnerable module to authorized internal networks only, and enable comprehensive audit logging of all high-privileged account activities. Within 30 days, establish a process to deploy the patch immediately upon vendor release; contact Oracle Support regarding interim workarounds or hardening configurations to reduce risk until a fix is available.

Oracle E-Business Suite CVE-2026-61009

EUVD-2026-47237 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-4w9m-w8p3-w383

Authentication Bypass Oracle E Business Suite

8.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.0 HIGH

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Reachable over HTTP (AV:N) but needs existing high EBS privilege (PR:H) and non-trivial conditions (AC:H); full takeover with cross-product scope change (S:C, C/I/A:H).

3.1 AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:12 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.0

DescriptionCVE.org

Vulnerability in the Oracle Process Manufacturing Logistics product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Logistics. While the vulnerability is in Oracle Process Manufacturing Logistics, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Process Manufacturing Logistics. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Process Manufacturing Logistics (a module of Oracle E-Business Suite) is possible for a high-privileged attacker who reaches the application over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 score of 8.0 elevated by a scope change (S:C), meaning successful attacks may significantly impact additional Oracle products beyond the vulnerable module. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, though exploitation is rated difficult (AC:H) and requires existing high privileges (PR:H).

Technical ContextAI

The affected component is Oracle Process Manufacturing Logistics (Internal Operations), part of the Oracle E-Business Suite (EBS) ERP platform - a Java/Oracle-database-backed application stack typically fronted by Oracle HTTP Server and accessed via HTTP. Oracle did not assign a CWE (CWE: N/A) and, following its standard CPU practice, withholds root-cause detail. The 'Information Disclosure' tag combined with full C/I/A impact and a scope change (S:C) suggests the flaw allows a privileged user of the Logistics module to break isolation boundaries and act on resources managed by other EBS components or the underlying platform. Exact affected products are the EBS Applications releases 12.2.3 through 12.2.15; no CPE strings were provided in the input.

RemediationAI

Apply the patches from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle delivers EBS fixes as CPU patch sets applied on top of the 12.2 release line rather than as a single renamed version, so no standalone fixed version number was provided in the input - consult the CPU advisory's patch availability table for the exact patch for your 12.2.x level. Because exploitation requires an already high-privileged account, compensating controls while patching include auditing and reducing the set of users holding elevated Process Manufacturing Logistics / EBS responsibilities, enforcing least-privilege on EBS responsibilities and menus, and restricting network access to the EBS HTTP endpoints to trusted internal management networks or VPN (trade-off: may disrupt legitimate remote or integration access and requires validating that batch/integration accounts retain needed connectivity). Increase monitoring of privileged EBS sessions for anomalous logistics/internal-operations activity.