What is the CVSS score of CVE-2026-61010?

CVE-2026-61010 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-61010?

Oracle Process Manufacturing Systems (part of E-Business Suite versions 12.2.3-12.2.15) contains a high-severity account takeover vulnerability (CVE-2026-61010, CVSS 8.8) exploitable by…

How to fix or mitigate CVE-2026-61010?

Within 24 hours: Identify all production and non-production systems running Oracle E-Business Suite versions 12.2.3 through 12.2.15 with the Process Manufacturing module enabled; implement network segmentation to restrict HTTP access to the module to known administrative networks only. Within 7 days: Obtain and validate Oracle's July 2026 Critical Patch Update in a staging environment, confirming compatibility with local configurations and dependent systems. Within 30 days: Deploy the July 2026 CPE to all affected production systems, prioritizing instances managing active manufacturing operations, and verify remediation by confirming successful patch application and functionality testing.

Oracle E-Business Suite CVE-2026-61010

EUVD-2026-47238 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-ww5m-hj69-pc6h

Privilege Escalation Oracle Process Manufacturing Systems

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reachable, low complexity, no user interaction, but a valid low-privilege EBS account is required (PR:L); flaw yields full module takeover, so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:12 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Process Manufacturing Systems product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Systems. Successful attacks of this vulnerability can result in takeover of Oracle Process Manufacturing Systems. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account/instance takeover in Oracle Process Manufacturing Systems (Internal Operations component of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access fully compromise the module, achieving high confidentiality, integrity, and availability impact. Oracle rates it CVSS 8.8 and calls it 'easily exploitable'; no public exploit is identified at time of analysis, and it is not listed in CISA KEV. The fix ships in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Process Manufacturing (OPM) Systems is a module within Oracle E-Business Suite (EBS), Oracle's flagship on-premises ERP platform, exposed over HTTP through the EBS web tier (typically Oracle HTTP Server / Oracle Application Server fronting the applications). The affected 'Internal Operations' sub-component handles back-end process-manufacturing operations. Oracle assigned no CWE (CWE: N/A), so the precise root-cause class is not published; however, the CVSS profile - network vector, low complexity, low privilege, unchanged scope, full CIA impact culminating in 'takeover' - is consistent with a broken-access-control or injection-class flaw that lets an authenticated low-privilege EBS user escalate to full control of the OPM module. The specific technical mechanism is withheld by Oracle's advisory-by-design summary.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html); Oracle delivers EBS security fixes as CPU patches applied to the 12.2 code line rather than as a new point release, so locate and apply the specific OPM/EBS 12.2 patch listed for CVE-2026-61010 in that CPU. Because Oracle strongly recommends never running unpatched or unsupported EBS, patching is the only vendor-supported remediation. Until the CPU is applied, reduce exposure by restricting network reachability of the EBS web tier - place it behind a VPN or IP allowlist so it is not internet-facing (side effect: disrupts legitimate remote users), tighten OPM-related responsibilities and revoke unnecessary low-privilege accounts since exploitation needs an authenticated user, and monitor EBS access logs for anomalous OPM/Internal Operations requests. These controls reduce but do not eliminate risk from a malicious or compromised internal account.