What is the CVSS score of CVE-2026-61019?

CVE-2026-61019 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Customers Online are affected by CVE-2026-61019?

Oracle E-Business Suite (versions 12.2.3-12.2.15) contains a critical vulnerability allowing authenticated users to read, create, modify, and delete sensitive business data.

How to fix or mitigate CVE-2026-61019?

Within 24 hours, restrict network access to Oracle E-Business Suite instances to authorized business locations and IP ranges, and implement comprehensive monitoring and alerting on all database queries and data modifications. Within 7 days, enforce multi-factor authentication (MFA) for all E-Business Suite users and conduct a complete privilege audit to remove unnecessary data access for low-privilege accounts. Within 30 days, work with Oracle to upgrade to version 12.2.16 or later, or deploy compensating controls including application-level access restrictions, database-level least-privilege policies, data masking for sensitive columns, and continuous audit logging of all read, write, and delete operations.

Oracle Customers Online CVE-2026-61019

EUVD-2026-47243 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-crgj-gp29-fv5q

Authentication Bypass Oracle Customers Online

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reachable with low-privilege authenticated access and no user interaction; full data read/write gives C:H/I:H, availability unaffected so A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:11 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Customers Online product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Customers Online. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Customers Online accessible data as well as unauthorized access to critical data or complete access to all Oracle Customers Online accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Broad data compromise in Oracle Customers Online (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, allows a low-privileged attacker with network HTTP access to read, create, modify, and delete all data accessible to the application. The CVSS 3.1 base score is 8.1 (C:H/I:H) reflecting high confidentiality and integrity impact with no availability effect. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Oracle Customers Online is a module within Oracle E-Business Suite (EBS), Oracle's integrated enterprise application stack for financials, CRM, HR, and supply chain. The affected component is 'Internal Operations', within the 12.2.x release family (12.2.3-12.2.15). The vendor-supplied tag 'Authentication Bypass' suggests the root cause is a broken authorization/authentication control that lets an already low-privileged user reach and manipulate data outside their intended scope. No CWE was assigned in the source data, but the described behavior is consistent with the improper-access-control / broken-authorization class (e.g., CWE-284/CWE-862/CWE-863). EBS is typically deployed as internet- or intranet-facing HTTP application servers, matching the AV:N vector.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Oracle CPU July 2026), documented at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle bundles fixes into CPUs rather than publishing standalone patched version numbers, so the accurate status is 'Patch available per vendor advisory' - apply the CPU patch corresponding to your 12.2.x level (12.2.3-12.2.15). Because this is a data-access/authorization flaw exploitable by low-privileged accounts, prioritize patching over workarounds. As compensating controls until the CPU is applied, restrict network reachability of the Customers Online HTTP endpoints to trusted internal segments or VPN (reduces AV:N exposure but blocks legitimate remote users), tighten and audit provisioning of low-privilege EBS accounts and responsibilities to limit who satisfies the PR:L prerequisite, and increase logging/monitoring of Customers Online data-access and modification activity to detect abuse (added log volume, no functional impact). No vendor-released standalone patch version was independently confirmed beyond the CPU advisory.