What is the CVSS score of CVE-2026-61050?

CVE-2026-61050 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle Production Scheduling CVE-2026-61050

EUVD-2026-47264 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-m2w9-hr6x-8rmv

Authentication Bypass Information Disclosure Oracle Production Scheduling

5.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible HTTP UI flaw requiring a low-privileged account and high-complexity conditions; confidentiality-only impact with no integrity or availability consequences stated or implied.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:30 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Production Scheduling. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Production Scheduling accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Production Scheduling (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged network attacker to gain complete read access to all data within the application via a difficult-to-exploit flaw in the User Interface component. Tagged as an authentication bypass, the vulnerability suggests improper access control enforcement in the UI layer that permits privilege escalation beyond the attacker's normally granted permissions, enabling full confidentiality compromise of Production Scheduling data. No public exploit code or active exploitation has been identified; Oracle addressed this in the Critical Patch Update for July 2026.

Technical ContextAI

Oracle Production Scheduling is a manufacturing planning and scheduling module within Oracle E-Business Suite (EBS), delivered via HTTP-accessible web interfaces as part of the 12.2.x release line. The vulnerability resides specifically in the User Interface component, suggesting a flaw in how the application enforces authorization or data-level access control on content rendered through the web layer. The intelligence tag 'Authentication Bypass' implies the UI fails to properly gate sensitive data - possibly through insecure direct object reference, missing server-side authorization checks, or session/token manipulation - enabling a low-privileged user to access data beyond their permitted scope. No CWE has been assigned by Oracle or NVD; however, the described behavior is consistent with CWE-284 (Improper Access Control) or CWE-639 (Authorization Bypass Through User-Controlled Key). The AC:H designation in the CVSS vector indicates that specific conditions - likely particular request sequences, application state, or session context - must align for successful exploitation. Affected versions span Oracle E-Business Suite Production Scheduling 12.2.3 through 12.2.15 per the ENISA EUVD-2026-47264 entry and Oracle's July 2026 CPU advisory.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, which addresses CVE-2026-61050 for Oracle Production Scheduling versions 12.2.3 through 12.2.15; the advisory is available at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched release version is not independently confirmed from available data - consult the Oracle advisory and My Oracle Support for the specific patch number, prerequisites, and application instructions. As a compensating control prior to patching, restrict network access to the Oracle EBS Production Scheduling UI to known, trusted internal IP ranges via perimeter firewall or network ACLs, directly addressing the AV:N attack vector and reducing exposure to adversaries with lateral network access. Additionally, audit low-privileged user accounts with access to the Production Scheduling module and remove unnecessary accounts or excess permissions, targeting the PR:L prerequisite that makes exploitation possible. Enable and review Oracle EBS application-level audit logging for anomalous data access patterns in the Production Scheduling component as a detection measure; note that this does not prevent exploitation but provides visibility for incident response.