What is the CVSS score of CVE-2026-61039?

CVE-2026-61039 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Advanced Supply Chain Planning are affected by CVE-2026-61039?

Organizations running Oracle E-Business Suite versions 12.2.3-12.2.15 face supply chain planning disruption if high-privileged accounts are compromised, allowing complete takeover of the Advanced…

How to fix or mitigate CVE-2026-61039?

Within 24 hours: Identify and document all systems running Oracle E-Business Suite versions 12.2.3-12.2.15 and categorize them by supply chain criticality level. Within 7 days: Apply Oracle's July 2026 Critical Patch Update to all affected systems in order of business criticality, and verify that the Advanced Supply Chain Planning module functions correctly post-patch. Within 30 days: Conduct a forensic audit of high-privilege account activities within E-Business Suite for the pre-patch period to identify any unauthorized supply chain planning module access, and implement enhanced transaction logging and alerting on supply chain planning module operations.

Advanced Supply Chain Planning CVE-2026-61039

EUVD-2026-47256 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-f9pr-gh9p-xp9x

Authentication Bypass Oracle Advanced Supply Chain Planning

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:06 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Advanced Supply Chain Planning product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Advanced Supply Chain Planning. Successful attacks of this vulnerability can result in takeover of Oracle Advanced Supply Chain Planning. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full product takeover in Oracle Advanced Supply Chain Planning (Core component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows an already high-privileged attacker with HTTP network access to fully compromise the module's confidentiality, integrity, and availability. Oracle rates it CVSS 3.1 7.2 and describes it as easily exploitable once the required elevated privileges are held. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle has addressed it in the July 2026 Critical Patch Update.