What is the CVSS score of CVE-2026-61048?

CVE-2026-61048 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.3%.

Oracle Inventory Optimization CVE-2026-61048

EUVD-2026-47262 LOW

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 secalert_us@oracle.com

GHSA-pvmx-r5q6-xx59

Denial Of Service Oracle E Business Suite

3.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

3.1 LOW

Network HTTP access required but high complexity and low privileges needed; impact confined to partial availability, no confidentiality or integrity exposure.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:30 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Inventory Optimization product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Inventory Optimization. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Inventory Optimization. CVSS 3.1 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L).

AnalysisAI

Partial denial of service in Oracle Inventory Optimization (E-Business Suite versions 12.2.3 through 12.2.15) can be triggered by a low-privileged attacker over HTTP, causing degraded availability of the User Interface component. The vulnerability carries a CVSS 3.1 base score of 3.1, reflecting high attack complexity and limited impact scope. No public exploit code or active exploitation has been identified at time of analysis, and Oracle addressed this in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle Inventory Optimization is a supply chain planning module within Oracle E-Business Suite (EBS), delivered as a web application and accessible via HTTP. The vulnerability resides in the User Interface component, suggesting a web-layer flaw - potentially improper input handling, resource exhaustion, or state mismanagement in the UI tier that can be triggered by crafted HTTP requests. No CWE identifier was provided, so the precise root cause class (e.g., uncontrolled resource consumption, improper error handling) cannot be confirmed from available data. Affected CPE aligns with Oracle E-Business Suite 12.2.3 through 12.2.15. The high attack complexity (AC:H) implies specific conditions or timing must be met for exploitation.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, available via Oracle Support and documented at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched version number is not independently confirmed from the available data beyond the CPU reference - consult My Oracle Support (MOS) for the specific patch ID applicable to your EBS release within the 12.2.3-12.2.15 range. As a compensating control prior to patching, consider restricting HTTP access to the Inventory Optimization UI component to trusted internal network segments or VPN-authenticated users, which raises the effective barrier given the AC:H requirement. Given the partial availability impact only, this is a standard CPU cycle patch with no urgent out-of-band action required for most organizations.