What is the CVSS score of CVE-2026-61064?

CVE-2026-61064 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle iRecruitment CVE-2026-61064

EUVD-2026-47276 MEDIUM

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-rvm4-33rh-6fhp

Privilege Escalation Oracle Irecruitment

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-accessible via HTTP with low-privilege authentication required; partial data read/write impact only, no scope change or availability impact confirmed.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:28 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Install / Upgrade Issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iRecruitment. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle iRecruitment accessible data as well as unauthorized read access to a subset of Oracle iRecruitment accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Unauthorized data access and manipulation in Oracle iRecruitment (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by any low-privileged attacker with network HTTP access, requiring no user interaction. The 'Authentication Bypass' tag from EUVD suggests the flaw likely allows an authenticated user to circumvent authorization controls within the Install/Upgrade component, gaining read and write access to recruitment data beyond their assigned permissions. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the low attack complexity makes this straightforward for any authenticated insider or compromised account.

Technical ContextAI

Oracle iRecruitment is a human resources recruitment module within Oracle E-Business Suite (EBS), a large-scale enterprise ERP platform deployed primarily in mid-to-large enterprises. The vulnerability resides in the 'Install / Upgrade Issues' component - a functional area associated with application setup and version migration routines, which may expose administrative or privileged data pathways to lower-privileged users. No CWE has been assigned by NVD, but the EUVD 'Authentication Bypass' tag is consistent with an authorization control flaw (e.g., improper access control, CWE-284, or broken authorization, CWE-863) rather than a full authentication bypass, given that CVSS requires PR:L (low privileges). The affected CPE covers Oracle E-Business Suite versions 12.2.3 through 12.2.15 per EUVD-2026-47276.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched version is not independently confirmed from the available data - Oracle CPU advisories typically require customers to apply the full CPU patch set and verify via My Oracle Support (MOS). As a compensating control prior to patching, restrict HTTP access to Oracle E-Business Suite instances to trusted internal network segments or VPN-authenticated users only, which limits the pool of low-privileged accounts that can reach the vulnerable component; note this does not eliminate risk from insider threats or already-compromised internal accounts. Additionally, audit user roles and privileges in iRecruitment to ensure the principle of least privilege is enforced, reducing the impact of any exploited authorization bypass.