What is the CVSS score of CVE-2026-61027?

CVE-2026-61027 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-61027?

Oracle Cost Management in E-Business Suite versions 12.2.3-12.2.15 is vulnerable to complete module compromise by authenticated high-privilege users, affecting financial data confidentiality,…

How to fix or mitigate CVE-2026-61027?

Within 24 hours, audit all high-privilege account holders in Oracle EBS and restrict Cost Management administrative access to essential personnel only. Within 7 days, apply Oracle's July 2026 Critical Patch Update to all affected E-Business Suite instances (versions 12.2.3 through 12.2.15), rolling out first to development environments, then production. Within 30 days, verify patch deployment completeness across your EBS estate, review Cost Management audit logs for any anomalous high-privilege activity prior to patching, and confirm least-privilege access controls remain in place post-remediation.

Oracle E-Business Suite CVE-2026-61027

EUVD-2026-47249 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-38cw-8m9p-rv35

Oracle Authentication Bypass Cost Management

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network HTTP reach (AV:N) with low complexity but requiring pre-existing high application privilege (PR:H); module takeover yields full C:H/I:H/A:H within one scope (S:U).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:08 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Inventory Costing). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Cost Management (Inventory Costing component) in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by an authenticated high-privileged attacker sending crafted HTTP requests over the network. Successful exploitation compromises confidentiality, integrity, and availability of the module, carrying a CVSS 3.1 base score of 7.2. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, though it was reported and fixed by Oracle in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle Cost Management is a financial/inventory module within the Oracle E-Business Suite (EBS) 12.2 application stack, running on the Oracle Application Server / WebLogic middleware tier and backed by an Oracle Database. The affected 'Inventory Costing' functionality is reached over HTTP through the EBS web tier. Oracle did not assign a specific CWE (CWE: N/A), so the exact root-cause class is not disclosed; the vendor tag 'Information Disclosure' and the C:H/I:H/A:H impact profile point to a flaw that lets a privileged user exceed their intended authorization and fully subvert the module. Because EBS 12.2 shares session and authentication context across many modules, a foothold in one privileged module often has broad reach.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor-released patch for this issue; no standalone exact fix build number was supplied in the intelligence, so identify the specific EBS 12.2 patch for your release level directly from the CPU advisory matrix. Because exploitation requires high application privileges, effective compensating controls until patching include tightening the assignment of Cost Management and Inventory responsibilities to the minimum set of trusted administrators, auditing and rotating credentials of high-privileged EBS accounts, and restricting network reachability of the EBS web tier so that only trusted internal hosts can send HTTP requests to the application. Trade-off: restricting responsibilities or web-tier access may disrupt legitimate finance/inventory operators, so validate role assignments before enforcing.