What is the CVSS score of CVE-2026-61111?

CVE-2026-61111 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Oracle E-Business Suite CVE-2026-61111

EUVD-2026-47322 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-98mw-gh37-7pm8

Oracle Authentication Bypass Application Object Library

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Local vector and low-privilege requirement are consistent with infrastructure logon prerequisite; scope change confirmed by description; confidentiality-only impact with no integrity or availability effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:22 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library. While the vulnerability is in Oracle Application Object Library, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Application Object Library accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Local privilege escalation via authentication bypass in Oracle Application Object Library (AOL) Core component exposes critical data across Oracle E-Business Suite 12.2.3 through 12.2.15. A low-privileged attacker with local system access can bypass authentication controls within AOL Core, gaining unauthorized read access to critical or complete AOL-accessible data - and, due to a confirmed scope change, potentially compromising additional integrated EBS products beyond AOL itself. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

Oracle Application Object Library (AOL) is a foundational framework component within Oracle E-Business Suite (EBS) responsible for core services including session management, user context, authentication, and data access control across EBS modules. The vulnerability resides in the Core sub-component of AOL. The CVSS vector (AV:L/PR:L/S:C) indicates the exploit executes locally on the infrastructure host where EBS is deployed, requires only low-level OS or application credentials, and produces a scope change - meaning the attacker can affect security properties of products beyond the directly vulnerable AOL component. The 'Authentication Bypass' tag suggests the Core component fails to properly enforce access control checks, allowing a low-privileged principal to read data it is not authorized to access. No specific CWE has been assigned by the reporter, leaving the precise root-cause class (e.g., broken access control, improper authorization) unconfirmed from available data.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, available via https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability for Oracle E-Business Suite 12.2.x. The exact patched version number within the 12.2.x line is not independently confirmed from available data - consult the Oracle CPU advisory and My Oracle Support for the specific patch number and prerequisites. As a compensating control while patching, restrict OS-level and application-level logon access to the EBS infrastructure to only those accounts with a verified business need, reducing the pool of potential low-privileged attackers. Enforce principle of least privilege on EBS application tier accounts and audit local user accounts on the EBS server. These controls reduce exploitation opportunity but do not eliminate the vulnerability; patching remains the definitive remediation.