What is the CVSS score of CVE-2026-61049?

CVE-2026-61049 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oracle Production Scheduling are affected by CVE-2026-61049?

Oracle Production Scheduling within E-Business Suite versions 12.2.3-12.2.15 can be fully compromised by unauthenticated attackers positioned on the same network segment who trick users into…

How to fix or mitigate CVE-2026-61049?

Within 24 hours, identify all systems running Oracle EBS versions 12.2.3-12.2.15 and isolate Production Scheduling components from untrusted network segments using network segmentation; begin documenting systems in scope and assessing their criticality to operations. Within 7 days, implement continuous behavioral monitoring on affected Production Scheduling processes and deploy targeted security awareness training on social engineering and suspicious interactions; review all network paths providing adjacent-network access to these systems. Within 30 days, establish a weekly process to monitor Oracle security advisories for vendor-released patches and maintain a pre-staged testing environment for immediate deployment once available; evaluate business continuity strategies including functional redundancy or air-gapping of critical scheduling components.

Oracle Production Scheduling CVE-2026-61049

EUVD-2026-47263 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-hwcj-3jh8-j3m9

Authentication Bypass Oracle Production Scheduling

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

Adjacent-segment access gives AV:A, difficult and interaction-dependent gives AC:H and UI:R, no credentials needed gives PR:N, and full component takeover gives C:H/I:H/A:H.

3.1 AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:04 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Production Scheduling executes to compromise Oracle Production Scheduling. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Production Scheduling. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Production Scheduling (part of Oracle E-Business Suite, Internal Operations component) is possible for an unauthenticated attacker positioned on the same physical/adjacent network segment as the host, provided a legitimate user is tricked into interacting. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation compromises the confidentiality, integrity, and availability of the Production Scheduling engine. There is no public exploit identified at time of analysis, and the high attack complexity combined with adjacent-network and user-interaction requirements substantially constrains real-world exploitability.

Technical ContextAI

Oracle Production Scheduling is a supply-chain planning module delivered within Oracle E-Business Suite 12.2.x, here specifically the Internal Operations component. The CVSS vector (AV:A) indicates the flaw is reachable only from the physical communication segment attached to the hardware running the service - i.e., adjacent network rather than the open internet - and requires human interaction (UI:R) from a victim other than the attacker, suggesting a client-side or session-mediated trigger such as a crafted response, file, or protocol exchange processed by a user's session. No CWE was assigned by NVD (CWE: N/A), so the precise root-cause weakness class (e.g., memory corruption, deserialization, or injection) cannot be confirmed from the provided data. The scope is unchanged (S:U), meaning impact is contained to the Production Scheduling component itself, but that impact is total (C:H/I:H/A:H), consistent with the described 'takeover' outcome.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html), which is the authoritative source for the exact patched version and patch numbers per affected 12.2.x release; Patch available per vendor advisory, though a single exact fixed version string is not enumerated in the provided data and should be taken from the Oracle CPU matrix. Until patches are applied, reduce exposure by tightly segmenting the network so the Production Scheduling host is not reachable from untrusted adjacent hosts - because the AV:A vector requires the attacker to sit on the same physical/adjacent segment, restricting that segment to trusted management systems removes the primary access path, at the trade-off of more restrictive operational connectivity. Additionally, since exploitation requires a victim to interact, reinforce user awareness and limit which accounts operate Production Scheduling client sessions to shrink the pool of potential interaction targets.