What is the CVSS score of CVE-2026-61080?

CVE-2026-61080 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Public Sector HR CVE-2026-61080

EUVD-2026-47291 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-788x-2g8r-8hcx

Authentication Bypass Oracle E Business Suite

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-reachable via HTTP with low-privilege authentication; partial confidentiality and integrity impact only, no availability impact or scope change confirmed by description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:26 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite (component: Regression Testing). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Human Resources. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Public Sector Human Resources accessible data as well as unauthorized read access to a subset of Oracle Public Sector Human Resources accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Unauthorized data access in Oracle Public Sector Human Resources (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged authenticated attacker operating over HTTP to read a subset of HR data and perform unauthorized insert, update, or delete operations within the Regression Testing component. The vulnerability is rated CVSS 5.4 Medium with no availability impact, confined to confidentiality and integrity. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag in the source intelligence warrants further investigation given its tension with the PR:L CVSS metric.

Technical ContextAI

Oracle E-Business Suite (EBS) is Oracle's integrated enterprise resource planning suite; the Public Sector Human Resources module is a government-targeted variant handling workforce, payroll, and HR data for public-sector organizations. The vulnerable component is specifically the Regression Testing sub-component of this module, suggesting the flaw may reside in test harness code or internal validation logic exposed over HTTP. The CWE is listed as N/A, which prevents definitive root-cause classification, but the 'Authentication Bypass' tag raises the possibility of improper authorization enforcement within an authenticated session context - distinct from bypassing login entirely. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U) confirms network-reachable exploitation requiring only a standard low-privilege EBS account, with no scope change to other system components.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, which addresses this vulnerability; the advisory is published at https://www.oracle.com/security-alerts/cpujul2026.html. An exact fixed version number is not independently confirmed from the available data - consult the CPU advisory directly for the applicable patch bundle for EBS 12.2.x. As an interim compensating control, restrict access to the Regression Testing component at the EBS responsibility and function-security level, limiting it only to users who operationally require it; this reduces the population of accounts that can trigger the vulnerability. Additionally, network-layer controls limiting HTTP access to the EBS application tier from untrusted network segments can reduce exposure, though this trades operational accessibility for risk reduction. Note that Oracle EBS patch application typically requires planned downtime and testing in complex environments.