What is the CVSS score of CVE-2026-61060?

CVE-2026-61060 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle EBS Secure Enterprise Search CVE-2026-61060

EUVD-2026-47272 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-vghx-3gg2-8c9j

Authentication Bypass Oracle E Business Suite Secure Enterprise Search

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L confirmed by Oracle description; partial C and I impacts align with bounded SES data scope; no availability impact noted.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:28 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle E-Business Suite Secure Enterprise Search product of Oracle E-Business Suite (component: Search Integration Engine). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Secure Enterprise Search. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle E-Business Suite Secure Enterprise Search accessible data as well as unauthorized read access to a subset of Oracle E-Business Suite Secure Enterprise Search accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Unauthorized data access in Oracle E-Business Suite Secure Enterprise Search versions 12.2.3 through 12.2.15 allows a low-privileged network attacker to read and modify data within the Search Integration Engine component via HTTP. Despite requiring a valid low-privilege account, the vulnerability is tagged as an Authentication Bypass, suggesting attackers can circumvent authorization controls within the search subsystem to access data beyond their permitted scope. No public exploit code or CISA KEV listing exists at time of analysis, and Oracle has addressed this in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle E-Business Suite (EBS) is Oracle's integrated enterprise resource planning (ERP) platform used extensively in large organizations for finance, HR, supply chain, and procurement. The Secure Enterprise Search (SES) component provides unified full-text search capabilities across EBS data sources. The Search Integration Engine is the backend integration layer that connects SES to EBS data crawlers and indexes. The vulnerability tagged 'Authentication Bypass' in this context most likely refers to an authorization bypass - the attacker holds a valid session (PR:L), but the Search Integration Engine fails to enforce proper access controls, allowing reads and writes beyond the attacker's authorized data scope. The CWE is listed as N/A by Oracle, which is atypical and limits root-cause classification; however, improper authorization (CWE-285) or missing access control enforcement (CWE-284) is consistent with the described behavior. Affected CPE covers EBS versions 12.2.3 through 12.2.15 on the 12.2 release line.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle's CPU process delivers patches via the My Oracle Support portal; organizations running EBS 12.2.3 through 12.2.15 should apply the applicable patch bundle for the Secure Enterprise Search component. An exact fixed release version is not independently confirmed beyond the CPU designation. As a compensating control prior to patching, restrict network access to the EBS application tier using perimeter controls or application-layer firewalls to limit HTTP access to the Search Integration Engine endpoints to authorized internal networks only - note this does not eliminate risk if the attacker already holds a valid low-privilege account within the network perimeter. Additionally, audit low-privilege account assignments in EBS to minimize the number of accounts that could be leveraged; removal of unnecessary accounts reduces the attack surface without impacting patching.