What is the CVSS score of CVE-2026-61028?

CVE-2026-61028 has a CVSS 3.1 base score of 1.9 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

Oracle Inventory Management CVE-2026-61028

EUVD-2026-47250 LOW

Improper Resource Shutdown or Release (CWE-404)

2026-07-21 secalert_us@oracle.com

GHSA-9wwq-39f3-hp52

Oracle Denial Of Service Inventory Management

1.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

1.9 LOW

AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

1.9 LOW

Local-only vector, high complexity and high existing privileges required; impact is solely partial availability loss with no confidentiality or integrity effect.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L

4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:32 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Inventory Management executes to compromise Oracle Inventory Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Inventory Management. CVSS 3.1 Base Score 1.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L).

AnalysisAI

Oracle Inventory Management within Oracle E-Business Suite 12.2.3 through 12.2.15 is susceptible to a local, highly constrained partial denial-of-service condition affecting only availability. Exploitation requires an already highly privileged attacker with direct logon access to the underlying infrastructure hosting the application, combined with high attack complexity, making successful exploitation extremely difficult in practice. No public exploit code or active exploitation has been identified; the CVSS score of 1.9 reflects the minimal real-world risk posed by this vulnerability.

Technical ContextAI

Oracle Inventory Management is a module within Oracle E-Business Suite (EBS), an enterprise resource planning platform widely used for supply chain and inventory operations. The vulnerability resides in the 'Internal Operations' component, though Oracle has not disclosed the specific CWE root cause class (CWE listed as N/A). The affected version range - 12.2.3 through 12.2.15 - spans a broad span of EBS 12.2 releases. The CVSS vector (AV:L/AC:H/PR:H) indicates the flaw is exercisable only from the local system infrastructure, not remotely over a network, and requires a highly privileged OS-level or application-level account. The impact is limited to partial availability degradation (A:L, S:U), with no confidentiality or integrity consequences.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU), available via https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability in Oracle E-Business Suite 12.2. Oracle does not publish exact patched version numbers outside of patch bundle identifiers within the CPU; customers should consult My Oracle Support for the specific patch applicable to their EBS 12.2 release level. Given the extremely limited attack surface - requiring local, high-privileged access - compensating controls that meaningfully reduce residual risk include enforcing strict OS-level account separation on EBS application servers, auditing and limiting accounts with local logon rights to EBS infrastructure, and monitoring privileged session activity via SIEM or PAM tooling. These controls also reduce risk from other local-privilege-class vulnerabilities simultaneously. Patching remains the definitive fix; compensating controls are supplements, not substitutes.