What is the CVSS score of CVE-2026-61024?

CVE-2026-61024 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle iRecruitment are affected by CVE-2026-61024?

Oracle iRecruitment (versions 12.2.3-12.2.15) contains a vulnerability enabling authenticated low-privileged users to read, create, delete, and modify all recruitment data without restriction, with a…

How to fix or mitigate CVE-2026-61024?

Within 24 hours: identify and document all systems running Oracle E-Business Suite iRecruitment versions 12.2.3-12.2.15 across your infrastructure. Within 7 days: restrict iRecruitment module HTTP access via firewall to only essential users and business networks, review and tighten role-based access controls for low-privileged accounts with iRecruitment access, and enable comprehensive audit logging for all iRecruitment data access and modifications. Within 30 days: apply the Oracle Critical Patch Update when released by the vendor, validate the patch through security testing in a non-production environment, and conduct a forensic review of access logs for any unauthorized iRecruitment activity during the vulnerability window.

Oracle iRecruitment CVE-2026-61024

EUVD-2026-47246 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-xchm-j8p6-3c55

Authentication Bypass Oracle Irecruitment

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reach with low complexity and no interaction, but a low-privilege account is required (PR:L); full data read/modify gives C:H/I:H, no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:09 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iRecruitment. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle iRecruitment accessible data as well as unauthorized access to critical data or complete access to all Oracle iRecruitment accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthorized data access and manipulation in Oracle iRecruitment (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-adjacent attacker read, create, delete, or modify all iRecruitment-accessible data over HTTP. The high CVSS 3.1 score of 8.1 reflects complete confidentiality and integrity compromise of the module with only a low-privilege account required and no user interaction. No public exploit identified at time of analysis, and it is not on CISA KEV; the vendor-supplied fix ships in the Oracle Critical Patch Update of July 2026.

Technical ContextAI

Oracle iRecruitment is the recruiting/applicant-tracking module of Oracle E-Business Suite (EBS), a large Java/PL-SQL enterprise ERP application served over HTTP/HTTPS via the Oracle Application Server tier and backed by the EBS database. The affected code lives in the 'Internal Operations' component. Oracle assigned no CWE, but the vendor-supplied tag 'Authentication Bypass' combined with the CVSS PR:L metric points to a broken access-control / authorization flaw: an authenticated low-privilege EBS user can reach functionality or data that should be restricted, escalating horizontally or vertically within iRecruitment rather than defeating authentication entirely. Because impact spans C:H and I:H with scope unchanged (S:U), the exposure is bounded to data and functions accessible through the iRecruitment module itself.

RemediationAI

Apply the fix delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory; no discrete fixed EBS point-release version was stated in the input) - consult https://www.oracle.com/security-alerts/cpujul2026.html and its linked patch documents for the exact patch numbers matching your 12.2.x level. Oracle CPUs are cumulative, so applying the current CPU also remediates prior fixes. As interim compensating controls until patching, restrict network reachability of the iRecruitment pages - for example, place the iRecruitment external/self-service URLs behind a WAF or reverse proxy with tightened access rules, disable or limit external/anonymous applicant self-registration if that responsibility is not needed, and review and minimize the responsibilities/roles that grant iRecruitment access to low-privilege accounts; note these controls may block legitimate external applicants and reduce recruiting functionality, so they are stopgaps rather than substitutes for the patch.