What is the CVSS score of CVE-2026-61030?

CVE-2026-61030 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-61030?

Oracle E-Business Suite's Process Manufacturing component (versions 12.2.3-12.2.15) contains a vulnerability enabling unauthorized access to and modification of critical manufacturing and product…

How to fix or mitigate CVE-2026-61030?

Within 24 hours, identify all E-Business Suite instances running versions 12.2.3 through 12.2.15, assess internet accessibility, and temporarily restrict network access to the Process Manufacturing component to trusted internal sources. Within 7 days, apply Oracle's July 2026 Critical Patch Update to all affected systems, prioritizing production environments. Within 30 days, validate successful patch deployment across all E-Business Suite systems, audit access logs for unauthorized data access attempts during the vulnerability window, and implement enhanced access controls limiting Process Manufacturing module access to authorized users.

Oracle E-Business Suite CVE-2026-61030

EUVD-2026-47251 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-2m8m-fx52-c3gr

Authentication Bypass Oracle Process Manufacturing Product Development

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reach with low complexity and no UI, but a low-privilege authenticated account is required (PR:L); high confidentiality and integrity impact, no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:07 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Product Development. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Process Manufacturing Product Development accessible data as well as unauthorized access to critical data or complete access to all Oracle Process Manufacturing Product Development accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle E-Business Suite's Oracle Process Manufacturing Product Development component (versions 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the module. Rated CVSS 8.1 with high confidentiality and integrity impact but no availability impact, it is addressed in Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, though the 'easily exploitable' characterization by Oracle and low attack complexity raise concern for internet-exposed EBS instances.

Technical ContextAI

Oracle E-Business Suite (EBS) is Oracle's integrated ERP/CRM application suite; the affected Oracle Process Manufacturing (OPM) Product Development module manages formulas, recipes, and specifications for process/batch manufacturers (food, pharma, chemicals). The flagged component is 'Internal Operations,' reached over HTTP through the EBS web tier. The CVSS vector (S:U) indicates the impact stays within the vulnerable component's authorization scope, meaning the attacker gains full read/write over data the OPM module itself can access. No CWE was assigned (CWE: N/A), so the precise root-cause class is not documented; the vendor supplied tag 'Authentication Bypass' conflicts with the CVSS PR:L metric and cannot be independently confirmed.

RemediationAI

Apply the fixes in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the primary and vendor-confirmed remediation path for EBS 12.2.3-12.2.15; Oracle CPU patches are cumulative, so applying the current CPU addresses this and other July 2026 fixes together. No standalone fixed version number is enumerated in the provided data beyond the CPU reference, so consult the CPU patch matrix for the exact patch ID for your EBS 12.2.x level. Until patching, compensating controls include restricting network reachability of the EBS web tier - place it behind a VPN or restrict the OPM Product Development URLs at a reverse proxy/WAF so only trusted internal networks can reach the Internal Operations endpoints (trade-off: may break legitimate remote/partner access) - and tightening account provisioning and monitoring for the low-privilege EBS accounts that could be abused, since exploitation requires an authenticated session per the CVSS PR:L metric.