What is the CVSS score of CVE-2026-61083?

CVE-2026-61083 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Performance Management CVE-2026-61083

EUVD-2026-47294 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-3fj9-xrg8-2rhj

Authentication Bypass Oracle E Business Suite

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network delivery over HTTP with low complexity; low-privilege account required; no availability impact; scope unchanged to Performance Management module only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:25 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Performance Management product of Oracle E-Business Suite (component: Appraisals). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Performance Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Performance Management accessible data as well as unauthorized read access to a subset of Oracle Performance Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Oracle Performance Management (E-Business Suite, Appraisals component, versions 12.2.3-12.2.15) exposes a network-accessible authorization bypass that allows low-privileged authenticated users to read and manipulate appraisal data beyond their intended access scope via HTTP. Tagged as an Authentication Bypass, the flaw enables partial confidentiality and integrity compromise against a widely-deployed enterprise ERP module. No public exploit code or CISA KEV listing has been identified at time of analysis; disclosure is tied to Oracle's CPU July 2026 advisory cycle.

Technical ContextAI

Oracle Performance Management is a licensed module within Oracle E-Business Suite (EBS), an enterprise ERP platform used by large organizations for HR, finance, and operations. The affected component is 'Appraisals,' which manages employee performance review workflows including goal-setting, appraisal submissions, and manager evaluations. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U) indicates exploitation over HTTP with low attack complexity, requiring only a valid low-privileged EBS account and no user interaction. The 'Authentication Bypass' tag suggests the vulnerability allows a low-privileged user to circumvent access control checks within the Appraisals component, accessing or modifying records associated with other users or roles. No CWE is formally assigned, but the behavior is consistent with CWE-284 (Improper Access Control) or CWE-862 (Missing Authorization). The affected version range is Oracle E-Business Suite 12.2.3 through 12.2.15, corroborated by ENISA EUVD-2026-47294.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, which addresses this vulnerability as part of Oracle E-Business Suite security fixes; the advisory is available at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched release version within the CPU bundle is not independently confirmed beyond the advisory reference - consult Oracle My Oracle Support (MOS) for patch applicability per EBS version. As a compensating control where immediate patching is not feasible, restrict network access to the EBS Appraisals module to only authorized HR administrators and relevant managers through Oracle EBS function security and network-layer controls; this reduces the attacker pool to a smaller, more accountable group but does not eliminate the underlying flaw. Reviewing and tightening Oracle EBS role assignments to enforce least-privilege on Performance Management responsibilities can further limit exposure. Monitor application-tier access logs for anomalous read or write activity in the Appraisals component as a detection measure.