What is the CVSS score of CVE-2026-61116?

CVE-2026-61116 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-61116?

A vulnerability in Oracle Application Object Library (Oracle E-Business Suite versions 12.2.3-12.2.15) allows unauthenticated attackers to access all data in the system, potentially exposing…

How to fix or mitigate CVE-2026-61116?

Within 24 hours: identify all systems running Oracle E-Business Suite versions 12.2.3 through 12.2.15 and assess data criticality to determine patching priority. Within 7 days: apply Oracle's July 2026 Critical Patch Update to all affected instances, coordinating with Oracle support if custom configurations complicate deployment. Within 30 days: audit access logs covering the period prior to patching to confirm no unauthorized access occurred, and verify patch deployment across the entire environment.

Oracle E-Business Suite CVE-2026-61116

EUVD-2026-47327 HIGH

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-2q86-qxmm-vmgc

Authentication Bypass Oracle Information Disclosure Application Object Library

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Description confirms remote unauthenticated HTTP access (AV:N/AC:L/PR:N/UI:N) yielding full read of accessible data (C:H) with no integrity or availability effect and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:43 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Application Object Library accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Application Object Library (a core component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a remote, unauthenticated attacker to compromise confidentiality over HTTP, resulting in unauthorized access to critical data or complete access to all data accessible to Oracle Application Object Library. Fixed in Oracle's July 2026 Critical Patch Update, the flaw is tagged as an authentication bypass and carries a CVSS 3.1 base score of 7.5 driven entirely by confidentiality impact (C:H, I:N, A:N). There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

Oracle Application Object Library (AOL/FND) is the foundational framework layer of Oracle E-Business Suite, providing shared services such as security, session and profile management, concurrent processing, and the underlying data model for virtually all EBS modules. Because AOL sits at the core, a confidentiality flaw here can expose data spanning many EBS applications rather than a single module. The vendor-supplied CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and the 'Authentication Bypass' tag indicate an HTTP-reachable code path that returns sensitive data without requiring a valid session, a common pattern in EBS servlets/JSPs that fail to enforce authorization. No CWE was assigned in the source data, but the described behavior - unauthenticated read access to protected data - aligns with the Missing Authentication / Improper Authorization class (CWE-306/CWE-862).

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the authoritative source for the exact patch numbers and per-version remediation for EBS 12.2.3-12.2.15; the input does not enumerate a single fixed build number, so consult the CPU matrix for the patch corresponding to your release. Patch available per vendor advisory (July 2026 CPU); no standalone fixed version string was provided in the source data, so do not assume a specific point release beyond what the CPU lists. As compensating controls until patched: restrict network reachability of the EBS web tier by placing it behind a VPN or IP allowlist and removing direct Internet exposure (trade-off: may block legitimate external self-service users such as iSupplier/iStore); deploy Oracle's URL Firewall / DMZ configuration and mod_security-style rules to block unauthenticated requests to the vulnerable AOL/FND servlet paths (trade-off: rule tuning risk of breaking valid flows); and monitor web-tier access logs for anomalous unauthenticated data-retrieval requests. These are stopgaps - the CPU patch is the only complete fix.