What is the CVSS score of CVE-2026-61107?

CVE-2026-61107 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-61107?

Oracle E-Business Suite (versions 12.2.3-12.2.15) contains a critical vulnerability in the DBA component that could allow authenticated high-privilege users to completely compromise the system, with…

How to fix or mitigate CVE-2026-61107?

Within 24 hours, identify all systems running Oracle E-Business Suite versions 12.2.3-12.2.15, verify current DBA component patch levels, and restrict HTTP network access to the Internal Operations component to only verified, authorized administrators. Within seven days, implement enhanced logging and monitoring of all privileged account activities on affected systems, enforce multi-factor authentication for high-privilege DBA accounts, and rotate all administrative credentials used for E-Business Suite access. Within 30 days, establish a vendor contact escalation plan for CVE-2026-61107 patch availability, plan and test an upgrade strategy to an unaffected E-Business Suite version, and document all access restrictions as interim compensating controls pending patch release.

Oracle E-Business Suite CVE-2026-61107

EUVD-2026-47318 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-wc95-cpqw-g35c

Privilege Escalation Oracle Applications Dba

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

HTTP-reachable so AV:N/AC:L, but requires pre-existing high EBS admin privileges (PR:H); full takeover yields C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:46 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications DBA. Successful attacks of this vulnerability can result in takeover of Oracle Applications DBA. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of the Oracle Applications DBA component (Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible for an authenticated, high-privileged attacker with HTTP network access, resulting in complete takeover with high confidentiality, integrity, and availability impact. Rated CVSS 3.1 7.2 (High) by Oracle in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Technical ContextAI

Oracle E-Business Suite is Oracle's flagship enterprise resource planning (ERP) suite; the affected 'Oracle Applications DBA' product is the administrative/DBA management layer within the suite, and the specific attack surface is the Internal Operations component exposed over HTTP through the EBS web/application tier. Because exploitation requires high privileges (PR:H), the root cause is most likely an improper access-control or privilege-handling weakness in an administrative operation rather than an unauthenticated input-parsing bug. Oracle did not assign a CWE (CWE: N/A) and provided no technical internals beyond the CVSS metrics, so the precise flaw class cannot be confirmed from the available data.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Patch available per vendor advisory, though Oracle's CPU model does not expose a single discrete fix version in the provided data, so identify the exact patch for your 12.2.x level from the CPU patch matrix and apply the current EBS 12.2.x Release Update Pack and quarterly security patch. Because exploitation requires high EBS privileges, the strongest compensating controls are tightening administrative access: restrict and audit accounts holding DBA/Applications-DBA-level roles, enforce least privilege on Internal Operations functions, and place the EBS application tier behind network segmentation so the HTTP interface is not broadly reachable. As a trade-off, restricting the Internal Operations endpoints or DBA console access may impede legitimate administrative automation, so validate against operational workflows before enforcing.