What is the CVSS score of CVE-2026-61051?

CVE-2026-61051 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Oracle E-Business Suite CVE-2026-61051

EUVD-2026-47265 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-6h8m-r8gw-q95c

Authentication Bypass Denial Of Service Oracle Concurrent Processing

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Network HTTP vector, no interaction required, low-privilege credential sufficient; partial CIA impact across unchanged scope aligns with description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:30 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Concurrent Processing accessible data as well as unauthorized read access to a subset of Oracle Concurrent Processing accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Concurrent Processing. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Oracle Concurrent Processing within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes a medium-severity flaw in its BI Publisher Integration component that allows a low-privileged, authenticated network attacker to compromise data integrity, read restricted data, and cause partial denial of service via HTTP. The vulnerability is described by Oracle as 'easily exploitable,' lowering the bar for abuse by any user holding a valid account. No public exploit code has been identified and it is not listed in the CISA KEV catalog at time of analysis, though its low attack complexity and no-UI-interaction requirements make it operationally straightforward once credentials are obtained.

Technical ContextAI

Oracle E-Business Suite (EBS) is Oracle's flagship integrated ERP platform used predominantly by large enterprises. The Concurrent Processing subsystem manages background batch job scheduling and report generation across EBS modules. The affected component is the BI Publisher Integration layer, which connects Concurrent Processing to Oracle's embedded reporting engine (BI Publisher) for output formatting and delivery. The absence of a CWE means the root cause class cannot be authoritatively stated from available data; based on the partial CIA impact profile (C:L/I:L/A:L) and the HTTP attack surface, the flaw likely involves insufficient authorization controls or improper input handling in API endpoints servicing report-related operations. Affected CPE is Oracle E-Business Suite Concurrent Processing versions 12.2.3 through 12.2.15.

RemediationAI

Apply Oracle's Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle's CPU process delivers patches through its My Oracle Support portal; administrators should consult MOS for the specific patch number applicable to their EBS release and platform. No explicit fixed version number was provided in the available advisory data beyond the CPU reference - the exact remediated release should be confirmed via the Oracle advisory before deployment. If immediate patching is not feasible, compensating controls include restricting network access to the EBS application tier to only known, trusted IP ranges or requiring VPN for all EBS access (reducing exposure of the HTTP attack surface), and auditing the list of active low-privilege EBS users with access to Concurrent Processing or BI Publisher-related responsibilities to minimize the attacker pool. Note that IP-restriction controls do not eliminate insider-threat risk given the PR:L requirement.