What is the CVSS score of CVE-2026-61110?

CVE-2026-61110 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-61110?

Oracle E-Business Suite versions 12.2.3 through 12.2.15 contain a critical privilege escalation vulnerability (CVSS 8.8) in the ADPatch component allowing low-privileged users with HTTP network…

How to fix or mitigate CVE-2026-61110?

Within 24 hours, identify and document all systems running Oracle E-Business Suite versions 12.2.3 through 12.2.15, particularly those exposed to untrusted networks. Within 7 days, implement network segmentation to restrict HTTP access to the Oracle Applications DBA component to only authorized administrative systems, enforce additional authentication layers for DBA subsystem access, and establish enhanced logging and monitoring for any access attempts to ADPatch-related components. Within 30 days, develop an upgrade roadmap to migrate to a patched version of Oracle E-Business Suite beyond 12.2.15, coordinate with your Oracle support team to confirm patch availability timelines, and complete deployment of interim compensating controls.

Oracle E-Business Suite CVE-2026-61110

EUVD-2026-47321 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-hjr3-ghjf-rjpq

Privilege Escalation Oracle Applications Dba

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable over HTTP with low complexity and no user interaction; requires a low-privileged EBS account (PR:L), yielding full C/I/A takeover of the unchanged-scope DBA component.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:46 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: ADPatch). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications DBA. Successful attacks of this vulnerability can result in takeover of Oracle Applications DBA. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Privilege escalation to full component takeover in Oracle E-Business Suite (Oracle Applications DBA, ADPatch component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the Oracle Applications DBA subsystem, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). Disclosed in Oracle's July 2026 Critical Patch Update, this is easily exploitable per Oracle's own rating. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege requirement make it a strong patching priority.

Technical ContextAI

Oracle E-Business Suite (EBS) is Oracle's flagship on-premises ERP suite bundling financials, HR, supply chain, and manufacturing modules on the Oracle Applications technology stack. The affected component, ADPatch, is part of the Applications DBA (AD) tooling used to apply patches and manage the EBS application tier; it is reachable over the HTTP-based application layer. The vulnerability permits an authenticated, low-privileged user to escalate into a takeover of the Applications DBA function. Oracle did not assign a CWE (CWE: N/A) and, per its long-standing CPU practice, withheld root-cause and vector-mechanism detail; the 'Information Disclosure' tag combined with the C:H/I:H/A:H vector indicates the flaw goes well beyond disclosure to full compromise of the administrative DBA component.

RemediationAI

Apply the fix delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory; Oracle CPUs ship the corrected ADPatch/AD component as part of the quarterly bundle) - consult https://www.oracle.com/security-alerts/cpujul2026.html and Oracle Support for the exact patch number matching your 12.2.x codelevel, as Oracle does not publish a discrete fixed version string. No exact fixed version was provided in the input, so do not assume a version number beyond what Oracle's CPU maps to your instance. Until patched, compensating controls include restricting network reachability of the EBS application tier and AD/ADPatch endpoints to trusted administrative networks or VPN only, tightening EBS application user provisioning to minimize low-privileged accounts that could serve as the PR:L foothold, and increasing monitoring/audit of patch-management and AD activity; the trade-off is that network restrictions may impede legitimate remote administration and self-service users. These are mitigations, not substitutes for the CPU patch.