What is the CVSS score of CVE-2026-61101?

CVE-2026-61101 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle MES are affected by CVE-2026-61101?

Oracle Manufacturing Execution System (MES) versions 12.2.3-12.2.15 contains a critical vulnerability that enables external attackers to extract proprietary manufacturing intelligence and sabotage…

How to fix or mitigate CVE-2026-61101?

Within 24 hours, inventory all Oracle E-Business Suite deployments with MES module versions 12.2.3 through 12.2.15 and assess network exposure, especially internet-facing or externally-accessible instances. Within 7 days, deploy Web Application Firewall (WAF) rules to block XSS-style payloads targeting MES endpoints, enforce multi-factor authentication for all MES access, enable detailed audit logging of all MES data queries and process modifications, and restrict MES access to trusted IP ranges and VPN only. Within 30 days, establish continuous monitoring of Oracle Security Advisories, prepare a staging environment for patch deployment upon vendor release, conduct penetration testing focused on MES attack surfaces, and evaluate upgrade feasibility for post-12.2.15 versions within your modernization roadmap.

Oracle MES CVE-2026-61101

EUVD-2026-47312 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-4prm-5gjq-3fmc

Authentication Bypass Oracle E Business Suite

8.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Remote unauthenticated but requires victim interaction (UI:R) and abuses their session (S:C); full data read (C:H), limited writes (I:L), no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:48 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.2

DescriptionCVE.org

Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle MES for Process Manufacturing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle MES for Process Manufacturing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle MES for Process Manufacturing accessible data as well as unauthorized update, insert or delete access to some of Oracle MES for Process Manufacturing accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).

AnalysisAI

Cross-site-scripting-style compromise in Oracle MES for Process Manufacturing (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a remote unauthenticated attacker steal or fully read Oracle MES-accessible data and make limited unauthorized changes by luring a legitimate user into interacting with a crafted HTTP request. The scope-changing nature (S:C) means a successful attack can significantly impact products beyond MES itself, typically the victim's authenticated session context. No public exploit identified at time of analysis and it is not listed in CISA KEV; Oracle rates it CVSS 8.2.

Technical ContextAI

Oracle MES for Process Manufacturing is a shop-floor execution module within Oracle E-Business Suite (EBS) 12.2, a large Java/PL-SQL enterprise ERP platform served over HTTP through the EBS web tier (Oracle Application Server / WebLogic and the OA Framework). The CWE is not assigned (N/A), but the CVSS signature - network vector, no privileges, mandatory human interaction, scope change, high confidentiality with low integrity and no availability impact - is the canonical profile Oracle uses for reflected/stored cross-site scripting or session-context injection flaws in the EBS UI layer, where attacker-controlled content is rendered in an authenticated operator's browser. The vendor's own 'Authentication Bypass' tag reflects the effect: the attacker never authenticates yet acts within a victim's authenticated session (S:C). No CPE strings were provided in the intelligence; affected products are identified only by the version range 12.2.3-12.2.15.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) to your EBS 12.2.x environment; the CPU is the vendor-released patch, though this intelligence set does not list a single discrete fixed build number, so confirm the exact patch/RUP level for your release on My Oracle Support. Because exploitation requires tricking an authenticated user, compensating controls until patching completes include restricting network exposure of the EBS/MES web tier (place it behind VPN or IP allow-listing rather than the public internet), enforcing a strict Content-Security-Policy and up-to-date browsers to blunt script injection, and warning MES operators about unsolicited links to EBS URLs (side effect: user friction, no functional loss). Do not rely on authentication alone, since the flaw is triggered through a legitimate user's session.