What is the CVSS score of CVE-2026-61026?

CVE-2026-61026 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle iRecruitment are affected by CVE-2026-61026?

Oracle iRecruitment (EBS 12.2.3-12.2.15) contains an unauthenticated remote vulnerability allowing unrestricted access to candidate records and hiring data, creating direct compliance exposure under…

How to fix or mitigate CVE-2026-61026?

Within 24 hours, inventory all internet-facing Oracle iRecruitment instances running EBS 12.2.3-12.2.15 and immediately restrict HTTP access via firewall rules or network segmentation; assess what recruitment data is currently accessible. Within 7 days, deploy a Web Application Firewall to enforce authentication on iRecruitment endpoints, enable comprehensive access logging and monitoring for detection of exploitation attempts, and implement network-level access controls limiting iRecruitment traffic to known internal sources. Within 30 days, contact Oracle Support to identify available upgrade paths (versions 12.2.16 or later if available, or alternative supported releases), execute the upgrade on non-production systems first for validation, and conduct a 90-day forensic audit of access logs to confirm no exploitation has occurred.

Oracle iRecruitment CVE-2026-61026

EUVD-2026-47248 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-wfqq-3q54-37qf

Authentication Bypass Oracle Irecruitment

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Remote unauthenticated HTTP bypass over the network (AV:N/AC:L/PR:N/UI:N) yielding full read of application data (C:H) with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:09 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iRecruitment. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iRecruitment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle iRecruitment (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a remote, unauthenticated attacker to reach all data accessible to the iRecruitment application over HTTP. The CVSS 3.1 base score is 7.5 with confidentiality-only impact (C:H, I:N, A:N), and the intelligence tag characterizes it as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network, no-auth, low-complexity vector makes it attractive for opportunistic scanning of internet-facing EBS deployments.

Technical ContextAI

Oracle iRecruitment is the recruitment/talent-acquisition module of Oracle E-Business Suite (EBS), a large Java/PL-SQL enterprise application suite fronted by Oracle Application Server / WebLogic and Apache-based web tiers. The affected 'Internal Operations' component and the 'Authentication Bypass' tag point to a flaw in the request-handling or session/authorization layer that lets requests reach protected data without valid credentials - a broken-authentication / improper-access-control class of issue (no CWE was supplied in the feed). Because iRecruitment often exposes external-facing candidate portals, the web front end is reachable over HTTP/HTTPS, and the confidentiality-only impact indicates the attacker can read data but the vector does not grant modification or availability impact.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update (CPU) fixes for E-Business Suite / iRecruitment as documented at https://www.oracle.com/security-alerts/cpujul2026.html - the CPU is the vendor-released patch and should be applied per Oracle's EBS patching guidance for the deployed 12.2.x release; no standalone fix version string was provided in this feed beyond the CPU reference. Until patched, reduce exposure by restricting network reachability of the iRecruitment web tier: place external candidate portals behind a WAF or reverse proxy that filters anomalous requests, remove or firewall internet-facing access to the Internal Operations endpoints where the candidate self-service function is not required (trade-off: external candidates cannot self-register/apply), and constrain access to trusted networks or VPN for internal-only deployments. Monitor EBS web-tier and access logs for unauthenticated requests reaching protected iRecruitment resources. These are compensating controls only; the CPU patch is the durable fix.