What is the CVSS score of CVE-2026-61115?

CVE-2026-61115 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Order Management are affected by CVE-2026-61115?

Oracle Order Management (E-Business Suite) in versions 12.2.3-12.2.15 is vulnerable to complete compromise via high-privilege user access, threatening the confidentiality, integrity, and availability…

How to fix or mitigate CVE-2026-61115?

Within 24 hours, identify all Oracle E-Business Suite Order Management systems running versions 12.2.3-12.2.15 and assess which grant HTTP access to high-privilege user accounts. Within 7 days, apply the Oracle Critical Patch Update released July 2026 to all affected production instances, with documented testing and rollback plans. Within 30 days, complete patching of non-production environments, verify patch installation on all systems, conduct a review of high-privilege account usage, and implement monitoring for suspicious Order Management access patterns.

Oracle Order Management CVE-2026-61115

EUVD-2026-47326 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-5g65-3chw-g74q

Authentication Bypass Oracle Order Management

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network HTTP reachability with low complexity but a required high-privileged EBS account (PR:H), no user interaction, and full module takeover giving C:H/I:H/A:H within unchanged scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:45 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Order Management. Successful attacks of this vulnerability can result in takeover of Oracle Order Management. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Order Management (part of Oracle E-Business Suite) is possible via the Product Diagnostic Tools component in supported releases 12.2.3 through 12.2.15, where an authenticated high-privileged user with HTTP network access can achieve a complete takeover of the module with confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a fix is delivered in the Oracle Critical Patch Update of July 2026.

Technical ContextAI

The affected technology is Oracle E-Business Suite, Oracle's flagship on-premises ERP application suite, specifically the Order Management module and its Product Diagnostic Tools component, which is exposed over HTTP as part of the EBS web tier. EBS runs on the Oracle Application Server/WebLogic middleware stack against an Oracle Database backend, and the Order Management module handles order-to-cash business processes. No CWE was supplied for this issue, so the precise root-cause class (for example injection, access-control flaw, or unsafe deserialization) cannot be confirmed from the data; the Product Diagnostic Tools component name suggests a diagnostic/administrative feature reachable by privileged users. No CPE strings were provided in the input, so exact affected configurations are derived from Oracle's own version statement rather than NVD CPE matching.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026, which delivers the fix for this issue (patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html); no discrete fixed component version number beyond the CPU is provided in the input, so consult the CPU patch matrix for the exact EBS 12.2.x patch that corresponds to your installed release. Because exploitation requires a high-privileged authenticated account, effective compensating controls until patching include tightening access to the Order Management and Product Diagnostic Tools functionality by restricting which users hold the elevated responsibilities/roles that can reach it, restricting network access to the EBS HTTP endpoints (for example limiting the diagnostic tool URLs to trusted admin networks or via reverse-proxy/WAF rules), and closely auditing privileged EBS account activity; note that restricting diagnostic tool access may hinder legitimate support and troubleshooting workflows. Do not defer patching on the assumption that PR:H alone is sufficient protection, since insider or compromised-admin scenarios remain viable.