What is the CVSS score of CVE-2026-61046?

CVE-2026-61046 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N. EPSS exploitation probability: 0.2%.

Oracle Production Scheduling CVE-2026-61046

EUVD-2026-47260 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-279v-p688-m7rm

Authentication Bypass Oracle E Business Suite

6.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N

vuln.today AI

6.6 MEDIUM

Consistent with vendor-provided vector: network HTTP delivery confirmed, AC:H and PR:H constrain reach, S:C reflects documented cross-product scope change, no availability impact described.

3.1 AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:32 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Production Scheduling. While the vulnerability is in Oracle Production Scheduling, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Production Scheduling accessible data as well as unauthorized read access to a subset of Oracle Production Scheduling accessible data. CVSS 3.1 Base Score 6.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N).

AnalysisAI

Oracle Production Scheduling (versions 12.2.3 through 12.2.15) contains a high-privilege network-exploitable flaw in its Internal Operations component that allows authorized but potentially abusive HTTP requests to bypass internal controls and achieve unauthorized creation, deletion, or modification of critical data, with a documented scope change that can cascade impact into adjacent Oracle E-Business Suite products. The vulnerability is tagged as an Authentication Bypass by both the Oracle reporter (secalert_us@oracle.com) and ENISA EUVD-2026-47260, introducing meaningful ambiguity against the CVSS PR:H designation. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the standard CPU patching priority tier despite the scope change.

Technical ContextAI

Oracle Production Scheduling is a manufacturing planning and scheduling module delivered as part of Oracle E-Business Suite (EBS), a comprehensive enterprise application suite built on Oracle Database and Oracle Application Server infrastructure. The affected component, Internal Operations, handles core scheduling logic accessible via HTTP over the application tier. Affected versions span 12.2.3 through 12.2.15, confirmed by EUVD-2026-47260. No CWE has been assigned in available NVD or Oracle advisory data, but the 'Authentication Bypass' tag from the Oracle security team suggests a root cause in the authorization or session validation layer - consistent with CWE-287 (Improper Authentication) or CWE-863 (Incorrect Authorization). The CVSS S:C (Scope Change) metric indicates the vulnerability's exploitation can propagate beyond the Production Scheduling module itself to other EBS components sharing the same application tier or database context, a common risk in tightly integrated ERP suites.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026 available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses CVE-2026-61046 in Oracle Production Scheduling. The exact patched release version is not independently confirmed in available intelligence beyond the CPU advisory reference - consult the Oracle CPU patch matrix to identify the correct patch for your installed version within the 12.2.3-12.2.15 range. As a compensating control pending patch application, restrict network access to the Oracle EBS application tier hosting Production Scheduling Internal Operations to known-good IP ranges or VPN-enforced network segments, reducing the AV:N exposure surface; note this does not eliminate risk from compromised insider accounts. Audit and minimize high-privilege accounts with access to the Production Scheduling component, as PR:H is nominally required - though the Authentication Bypass tag suggests this control may be partially circumventable. Given the S:C scope change, delayed patching exposes adjacent Oracle EBS products to secondary integrity impact, which should factor into patching urgency decisions.