What is the CVSS score of CVE-2026-61037?

CVE-2026-61037 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Loans are affected by CVE-2026-61037?

Oracle E-Business Suite versions 12.2.3 through 12.2.15 contain a critical vulnerability in the Loans module that exposes financial data to manipulation and unauthorized access by any user with basic…

How to fix or mitigate CVE-2026-61037?

Within 24 hours, identify all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15 with the Loans module enabled and determine which systems are accessible over the network. Within 7 days, restrict network HTTP access to the Loans module through firewall rules and VPN requirements, enforce principle of least privilege for database and application accounts, and enable comprehensive audit logging for all Loans data operations. Within 30 days, monitor Oracle security advisories for patch availability, contact Oracle Support for a remediation timeline, and evaluate whether interim compensating controls adequately address the risk posture if patches remain unavailable.

Oracle Loans CVE-2026-61037

EUVD-2026-47255 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-9c97-mw67-4gv7

Authentication Bypass Oracle Loans

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP access with low attack complexity, requires a low-privileged authenticated account (PR:L), no UI; high confidentiality and integrity impact but no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:06 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Loans product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Loans. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Loans accessible data as well as unauthorized access to critical data or complete access to all Oracle Loans accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Loans (Internal Operations component of Oracle E-Business Suite 12.2.3-12.2.15) allows a low-privileged attacker with network HTTP access to read, create, delete, or modify all Loans-accessible data. The flaw yields high confidentiality and integrity impact without affecting availability, and carries a CVSS 3.1 base score of 8.1. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected technology is Oracle E-Business Suite (EBS), Oracle's integrated enterprise business application stack, specifically the Oracle Loans module and its Internal Operations component. EBS is a web-tier application typically fronted by Oracle HTTP Server and accessed over HTTP, which aligns with the AV:N/HTTP attack surface. No CWE was assigned by NVD; the vendor tag 'Authentication Bypass' combined with the CVSS PR:L metric suggests an access-control or authorization weakness (broadly CWE-285/CWE-863 class) where an authenticated but low-privileged user can reach data or operations beyond their intended authorization scope rather than a pre-authentication bypass. Because Oracle publishes only summary-level details in its quarterly Critical Patch Update, the precise root-cause mechanism is not disclosed.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) - the specific patched EBS 12.2 patch level is not enumerated in the available data, so consult the CPU matrix for the exact patch number for your release before deploying (Patch available per vendor advisory; no independently confirmed fix version). No vendor-released standalone patch version was identified beyond the CPU in the input, so treat the CPU bundle as the primary fix. As compensating controls until patching, restrict network access to the Oracle Loans/Internal Operations URLs to trusted internal networks or VPN (trade-off: may block legitimate remote loan-processing users), place the EBS web tier behind a WAF with rules limiting access to authenticated Loans endpoints, and review and tighten Oracle Loans responsibility/role grants to minimize low-privileged accounts that can reach the affected functionality (trade-off: may require re-provisioning some user duties). Increase monitoring of EBS access logs for anomalous data creation, deletion, or modification in Loans.