What is the CVSS score of CVE-2026-61047?

CVE-2026-61047 has a CVSS 3.1 base score of 1.9 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Oracle Production Scheduling CVE-2026-61047

EUVD-2026-47261 LOW

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-59v2-3gp4-pxq2

Authentication Bypass Oracle E Business Suite

1.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

1.9 LOW

AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

1.9 LOW

Local-only access (AV:L), high complexity conditions (AC:H), and high privilege requirement (PR:H) match description; sole impact is limited data integrity write.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N

4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:30 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Production Scheduling executes to compromise Oracle Production Scheduling. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Production Scheduling accessible data. CVSS 3.1 Base Score 1.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N).

AnalysisAI

Oracle Production Scheduling (E-Business Suite component) exposes an integrity-only vulnerability exploitable exclusively by high-privileged local attackers on the hosting infrastructure, across versions 12.2.3 through 12.2.15. Successful exploitation permits unauthorized write operations - insert, update, or delete - against a subset of the scheduling module's data, with no confidentiality or availability impact. No public exploit code exists and the vulnerability is not listed in CISA KEV; the extremely low CVSS score of 1.9 reflects the steep exploitation barrier imposed by local access and high privilege prerequisites.

Technical ContextAI

Oracle Production Scheduling is a manufacturing planning and execution component of Oracle E-Business Suite, an enterprise-class ERP suite. The vulnerability resides in the 'Internal Operations' sub-component, suggesting the flaw exists within server-side logic executed on the application or database tier hosting the EBS instance. The CVSS vector (AV:L) confirms the attack vector is local - requiring direct logon to the infrastructure host, not a remote network path. No CWE is assigned, so the precise root cause class (e.g., improper authorization, TOCTOU race, insecure file handling) is not formally classified. The 'Authentication Bypass' tag in the intelligence feed is noteworthy given PR:H in the CVSS vector; this may indicate a partial internal authorization bypass that is reachable only after obtaining high-privileged OS or application access, rather than a full pre-auth bypass. Affected CPE covers Oracle E-Business Suite versions 12.2.3 through 12.2.15.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability across the affected 12.2.3-12.2.15 version range. Oracle does not publicly disclose exact patched version numbers outside the CPU documentation, so consult the advisory for patch identifiers applicable to your specific EBS version. As an interim compensating control, restrict OS-level and application-tier logon access to the Production Scheduling host to only those accounts that operationally require it, reducing the pool of principals who could meet the PR:H prerequisite; note that this mitigation addresses access hygiene rather than the underlying flaw and does not substitute for patching. Ensure that privileged service accounts running the Internal Operations component follow least-privilege principles.