What is the CVSS score of CVE-2026-61043?

CVE-2026-61043 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N. EPSS exploitation probability: 0.1%.

Oracle Production Scheduling CVE-2026-61043

EUVD-2026-47258 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-77q4-m5g2-wrpv

Oracle Authentication Bypass E Business Suite

6.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.7 MEDIUM

AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N

vuln.today AI

6.7 MEDIUM

Local-only access, low-privilege logon, and mandatory third-party interaction align precisely with the Oracle description; scope change and high integrity loss reflect cross-product data modification capability with no availability impact stated.

3.1 AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:32 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Production Scheduling executes to compromise Oracle Production Scheduling. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Production Scheduling, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Production Scheduling accessible data as well as unauthorized read access to a subset of Oracle Production Scheduling accessible data. CVSS 3.1 Base Score 6.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N).

AnalysisAI

Oracle Production Scheduling versions 12.2.3 through 12.2.15 in Oracle E-Business Suite exposes a local exploitation path through its Internal Operations component, enabling a low-privileged attacker - given co-presence of a second interacting user - to achieve unauthorized creation, deletion, or modification of critical data with a scope change that can cascade impact to additional Oracle EBS products. Tagged as an authentication bypass by ENISA EUVD-2026-47258, the flaw is addressed in Oracle's Critical Patch Update for July 2026. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Oracle Production Scheduling is a planning and scheduling module within Oracle E-Business Suite (EBS), widely used in manufacturing and supply-chain operations. The vulnerability resides in the Internal Operations component across versions 12.2.3 through 12.2.15 (confirmed per ENISA EUVD-2026-47258 and Oracle CPU July 2026). No CWE has been assigned, but the 'Authentication Bypass' tag from ENISA suggests the flaw involves circumventing internal authorization controls rather than defeating the initial login mechanism - consistent with a post-logon privilege boundary bypass within the local process context. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N) indicates low-complexity local exploitation requiring low-privilege credentials and human interaction, with a scope change meaning successful exploitation can affect Oracle components beyond Production Scheduling itself within the broader EBS environment.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, which addresses this vulnerability and is documented at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched release version number was not independently extractable from the available reference data - consult Oracle's CPU patch set documentation and My Oracle Support for the specific patch identifiers applicable to your EBS installation. Where immediate patching is not feasible, restrict local logon access to Production Scheduling infrastructure to only operationally necessary accounts, enforcing least-privilege principles to shrink the pool of eligible low-privilege users who could serve as attackers. Because exploitation also requires human interaction from a second user (UI:R), reducing unnecessary interactive sessions on Production Scheduling hosts further limits the viable attack surface. Implement host-level activity monitoring on EBS Production Scheduling servers to detect anomalous internal operations activity that could indicate exploitation attempts.