What is the CVSS score of CVE-2026-61014?

CVE-2026-61014 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Inventory Management are affected by CVE-2026-61014?

Oracle Inventory Management (versions 12.2.3-12.2.15) contains an authentication-bypass class vulnerability allowing authenticated low-privileged users to read sensitive operational data across the…

How to fix or mitigate CVE-2026-61014?

Within 24 hours, identify all systems running Oracle E-Business Suite versions 12.2.3 through 12.2.15 and confirm which host the Inventory Management component; inventory this exposure scope to inform risk response. Within 7 days, implement network-layer access controls restricting HTTP/HTTPS traffic to the Inventory Management application to authorized personnel only, restrict assignment of new low-privilege application accounts pending patch availability, and enable enhanced logging and monitoring of data access queries against inventory tables. Within 30 days, apply the vendor patch when Oracle releases it in the July 2026 Critical Patch Update, and verify patch deployment across all affected systems before restoring full operational access.

Oracle Inventory Management CVE-2026-61014

EUVD-2026-47241 HIGH

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-7q6r-9xr4-xg49

Authentication Bypass Oracle Information Disclosure Inventory Management

7.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network HTTP reachable with low complexity, requires a low-privileged authenticated account (PR:L), scope change (S:C) reaching other modules, and confidentiality-only high impact with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:11 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.7

DescriptionCVE.org

Vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Inventory Management. While the vulnerability is in Oracle Inventory Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Inventory Management accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Inventory Management (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read all data accessible to the application, with a scope change that can significantly impact other Oracle EBS products. Rated CVSS 3.1 7.7 (confidentiality-only), the flaw is easily exploitable over HTTP and is tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; fixes ship in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

The affected technology is Oracle E-Business Suite, Oracle's web-based ERP platform, specifically the Inventory Management module's Internal Operations component. The CVSS scope change (S:C) indicates the vulnerable component can be leveraged to reach data governed by other authorization contexts within the shared EBS stack - typical of EBS's monolithic mid-tier where modules share a common Oracle Application Server/WebLogic and database schema. The 'Authentication Bypass' tag combined with PR:L and confidentiality-only impact suggests an authorization/access-control weakness (broken function or object-level access control, CWE-284/CWE-639 class) allowing a legitimate low-privileged user to reach records they should not see. Note the CWE is listed as N/A in the source data, so the exact root-cause class is inferred from the vector and tag, not vendor-confirmed.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle CPU patches are cumulative and version-specific to your EBS 12.2.x level, so identify your exact release (12.2.3-12.2.15) and apply the corresponding patch - Patch available per vendor advisory, though this analysis does not have a discrete fix build number to cite. Until patched, reduce exposure by restricting network access to the EBS mid-tier and the Inventory Management/Internal Operations endpoints to trusted internal networks or VPN, tightening application user privileges to remove unnecessary low-privileged accounts, and enabling URL firewall/allowlisting via the EBS DMZ configuration to limit externally reachable modules (trade-off: URL allowlisting can break legitimate self-service functions and requires careful testing). Increase monitoring of Inventory Management data-access audit logs for anomalous cross-module reads as a detective control.