What is the CVSS score of CVE-2026-61031?

CVE-2026-61031 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-61031?

Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15 contain a critical vulnerability in the Financials module allowing low-privileged users to read, create, delete, and modify all financial…

How to fix or mitigate CVE-2026-61031?

Within 24 hours, conduct a complete inventory of Oracle EBS deployments to identify systems running versions 12.2.3 through 12.2.15 and classify by financial data sensitivity. Within 7 days, obtain Oracle's July 2026 Critical Patch Update, test it thoroughly in a non-production environment, and begin staged deployment to production systems starting with the most critical financial instances. Complete rollout of the July 2026 CPU to all affected EBS versions within 30 days and validate remediation through access control testing to confirm low-privileged accounts can no longer read or modify financial data.

Oracle E-Business Suite CVE-2026-61031

EUVD-2026-47252 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-xqhm-j424-37fr

Authentication Bypass Oracle E Business Suite

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP access with a low-privilege account and no interaction yields high confidentiality and integrity impact; no availability effect per Oracle's description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:07 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Financials Common Country product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financials Common Country. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financials Common Country accessible data as well as unauthorized access to critical data or complete access to all Oracle Financials Common Country accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Financials Common Country (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1, the flaw affects EBS versions 12.2.3 through 12.2.15 and impacts confidentiality and integrity but not availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it appears in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Financials Common Country is a shared financials module within Oracle E-Business Suite (EBS), a large web-based enterprise resource planning (ERP) suite deployed on the Oracle Application Server / WebLogic middleware tier and Oracle Database backend. The affected 'Internal Operations' component is reached over HTTP, consistent with the AV:N vector. Oracle did not assign a CWE (CWE: N/A), so the precise root-cause class is not published; the C:H/I:H/A:N impact profile combined with PR:L indicates an authorization/access-control weakness where an already-authenticated low-privilege user can reach and manipulate data beyond their intended scope. The third-party 'Authentication Bypass' tag conflicts with Oracle's own PR:L vector, which requires valid low-level credentials rather than no authentication.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update, which contains the fix for this issue, per the advisory at https://www.oracle.com/security-alerts/cpujul2026.html (patch available per vendor advisory; no standalone fix version string was provided in the input, so cite the CPU rather than an invented version number). Because Oracle EBS patches are delivered as consolidated CPU bundles, schedule the update through the standard EBS patching process against your 12.2.x environment. As compensating controls until patching, restrict network reachability of the EBS application tier and the Financials Common Country / Internal Operations functions to trusted internal users via network segmentation and reverse-proxy access rules, tighten role/responsibility assignments so low-privilege accounts cannot reach this module, and increase monitoring of EBS audit logs for unexpected data creation, modification, or deletion - noting these controls reduce but do not eliminate risk for an insider or a compromised low-privilege account.