What is the CVSS score of CVE-2026-61023?

CVE-2026-61023 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Oracle Inventory Management CVE-2026-61023

EUVD-2026-47245 MEDIUM

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-pvc9-vq4j-gwrg

Oracle Privilege Escalation Inventory Management

6.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.4 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.4 MEDIUM

Local infrastructure logon and high OS-level privileges are required preconditions; high complexity reflects the difficult-to-exploit nature stated by Oracle.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:33 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Inventory Management executes to compromise Oracle Inventory Management. Successful attacks of this vulnerability can result in takeover of Oracle Inventory Management. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Inventory Management (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a high-privileged attacker with local infrastructure access exploiting a flaw in the Internal Operations component. The CVSS vector (AV:L/AC:H/PR:H) places this firmly in the category of post-compromise or insider-threat scenarios rather than remote opportunistic attacks, yet the confirmed C:H/I:H/A:H impact means a successful exploitation yields complete control of the affected instance. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle Inventory Management is a core module of Oracle E-Business Suite (EBS), an on-premises ERP platform widely deployed in manufacturing, supply chain, and logistics environments. The affected component is 'Internal Operations,' which handles backend processing within the EBS application tier. No CWE identifier was assigned by Oracle or NVD, so the precise root-cause class cannot be confirmed from available data. The CVSS local attack vector (AV:L) indicates the flaw is exercised from within the server or host infrastructure on which EBS executes - consistent with a privileged OS-level or application-tier session rather than a network-facing interface. The affected CPE range spans EBS versions 12.2.3 through 12.2.15 per EUVD-2026-47245 and the NVD entry.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, which addresses this vulnerability. The advisory is published at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publicly disclose specific patched version numbers outside of My Oracle Support, so administrators should consult MOS patch recommendations for their 12.2.x release. The exact fix version was not independently confirmed from available references. If immediate patching is not possible, compensating controls should focus on constraining local infrastructure access: enforce strict OS-level privilege separation between EBS application accounts and administrative users, audit and restrict who holds DBA or applmgr-equivalent credentials on EBS hosts, and enable OS-level auditing of processes spawned under the application owner account. Restricting SSH and remote desktop access to EBS application servers to only named, MFA-authenticated personnel reduces the attacker's ability to establish the local logon prerequisite. These mitigations carry trade-offs in operational flexibility for DBAs and EBS administrators and should be implemented with change-management review.