What is the CVSS score of CVE-2026-61044?

CVE-2026-61044 has a CVSS 3.1 base score of 4.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Oracle Production Scheduling CVE-2026-61044

EUVD-2026-47259 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-gv8g-w85x-w524

Authentication Bypass Denial Of Service Oracle E Business Suite

4.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.7 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

4.7 MEDIUM

Network-accessible via HTTP with no interaction required, but PR:H reflects mandatory high-privilege authentication; partial C/I/A impacts and no scope change are consistent with a contained internal operations flaw.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:31 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Production Scheduling. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Production Scheduling accessible data as well as unauthorized read access to a subset of Oracle Production Scheduling accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Production Scheduling. CVSS 3.1 Base Score 4.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Oracle Production Scheduling versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes its Internal Operations component to exploitation by high-privileged remote attackers over HTTP. Successful exploitation yields partial unauthorized read and write access to accessible data alongside a partial denial of service condition. No public exploit code or confirmed active exploitation has been identified at time of analysis; CVSS score of 4.7 (Medium) reflects the significant mitigation from the high-privilege prerequisite.

Technical ContextAI

Oracle Production Scheduling is a planning and scheduling module within Oracle E-Business Suite (EBS), targeting manufacturing and production environments. The affected component is identified as Internal Operations, suggesting server-side processing logic accessible over HTTP - consistent with the AV:N vector. Affected releases span 12.2.3 through 12.2.15, a broad version band indicating the flaw was introduced early in the 12.2.x release line and persisted across multiple CPU cycles. No CWE has been assigned, so the root cause class (e.g., injection, improper authorization, logic flaw) cannot be determined from available data. The S:U scope indicates exploitation is contained within the Oracle Production Scheduling application boundary and does not propagate to other system components.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability across the affected 12.2.3-12.2.15 release range. An exact patched version number was not independently confirmed from available data - consult the Oracle CPU advisory directly for the precise patch set identifier and installation instructions. As a compensating control where immediate patching is not feasible, restrict HTTP network access to Oracle Production Scheduling Internal Operations endpoints to only explicitly authorized high-privilege accounts via network-layer ACLs or EBS access controls, reducing the pool of potential actors who could exploit this path. Audit and minimize the number of accounts holding high-privilege roles within Oracle Production Scheduling to further constrain exposure.