What is the CVSS score of CVE-2026-61113?

CVE-2026-61113 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-61113?

Oracle Application Object Library (the core framework layer of Oracle E-Business Suite versions 12.2.3-12.2.15) contains an unauthenticated remote vulnerability allowing attackers to read, create,…

How to fix or mitigate CVE-2026-61113?

Within 24 hours, conduct a complete inventory of Oracle E-Business Suite deployments and identify all systems running versions 12.2.3 through 12.2.15, including development, test, and production environments. Within 7 days, implement network-level access controls restricting HTTP/HTTPS connectivity to Application Object Library components to authorized internal networks only, deploy enhanced logging and real-time alerting for data access and modification events against critical data, and perform a baseline integrity audit of sensitive financial and operational records. Within 30 days, establish direct engagement with Oracle Support to confirm patch availability timeline and security update roadmap, develop and validate a migration plan to versions 12.2.16 or later, and schedule a post-remediation audit to confirm compensating control effectiveness.

Oracle E-Business Suite CVE-2026-61113

EUVD-2026-47324 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-2gp7-3rf2-fjhq

Authentication Bypass Oracle Application Object Library

7.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

Unauthenticated HTTP-reachable flaw (AV:N/PR:N/UI:N) with high complexity per vendor (AC:H); full data read and modification give C:H/I:H, no availability impact (A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:45 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.4

DescriptionCVE.org

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Application Object Library accessible data as well as unauthorized access to critical data or complete access to all Oracle Application Object Library accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Remote data compromise in Oracle Application Object Library (the shared framework layer of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows an unauthenticated network attacker to read, create, delete, or modify all data accessible to the component over HTTP. The high attack complexity (AC:H) makes reliable exploitation non-trivial, but success yields full confidentiality and integrity impact against a core ERP platform. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor tags associate it with an authentication bypass pattern.

Technical ContextAI

Oracle Application Object Library (FND/AOL) is the foundational technology stack shared across all Oracle E-Business Suite modules - it provides session management, security, forms, and concurrent-processing services that other EBS applications build on. Because the flaw resides in this Core component, any weakness propagates broadly across the suite. The vendor's 'Authentication Bypass' tag, combined with PR:N (no privileges required) and C:H/I:H impacts, indicates the root cause is likely improper authentication or access-control enforcement (CWE class such as CWE-287/CWE-306), allowing a request to reach protected data paths without valid credentials. No CWE was assigned in the source data, so this classification is inferred from the vector and tags rather than confirmed.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); patch available per vendor advisory, though the source data does not specify an exact patched build number, so consult the CPU matrix for the correct patch for your 12.2.x level. As compensating controls until patched, restrict network reachability of the EBS HTTP tier by placing it behind a VPN or reverse proxy and blocking direct Internet exposure, and enforce URL/access filtering at the Oracle HTTP Server or a web application firewall to constrain unauthenticated requests to Application Object Library endpoints - note this can break legitimate external self-service (iSupplier/iStore) access and should be tested against business workflows. Increase monitoring of FND/AOL access logs for anomalous unauthenticated requests to sensitive endpoints as a detective control.