What is the CVSS score of CVE-2026-61125?

CVE-2026-61125 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-61125?

A data disclosure vulnerability in Oracle E-Business Suite's Configure to Order component (versions 12.2.3-12.2.15) allows any authenticated user to access sensitive application data, with its…

How to fix or mitigate CVE-2026-61125?

Within 24 hours: inventory all Oracle E-Business Suite instances, confirm which run versions 12.2.3 through 12.2.15, and identify all downstream systems and business processes that depend on Configure to Order data. Within 7 days: implement access controls restricting Configure to Order functionality to essential authenticated users only, enable comprehensive audit logging for all data access and exports, and establish 24/7 monitoring for anomalous data retrieval patterns. Within 30 days: engage Oracle support to obtain emergency patch information or alternative mitigation strategies, and develop a remediation roadmap that may include version upgrades or architectural changes to reduce exposure.

Oracle E-Business Suite CVE-2026-61125

EUVD-2026-47334 HIGH

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-c2xw-cg5f-j76x

Authentication Bypass Information Disclosure Oracle E Business Suite

7.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network HTTP reachable and easily exploitable (AV:N/AC:L), needs a low-privileged account (PR:L), no interaction, confidentiality-only with cross-product scope change (S:C/C:H/I:N/A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:42 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.7

DescriptionCVE.org

Vulnerability in the Oracle Configure to Order product of Oracle E-Business Suite (component: Supply to Order Workbench). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Configure to Order. While the vulnerability is in Oracle Configure to Order, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configure to Order accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Configure to Order (Supply to Order Workbench component) of Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read all data accessible to the application and, because of a scope change, to impact additional Oracle products beyond Configure to Order. Oracle rates it CVSS 3.1 7.7 with confidentiality-only impact and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it was reported through Oracle's own security alert channel for the July 2026 Critical Patch Update.

Technical ContextAI

Oracle Configure to Order (CTO) is a manufacturing/order-management module within the Oracle E-Business Suite ERP platform, and the flaw resides specifically in its Supply to Order Workbench component, which is exposed over HTTP as part of the EBS web tier (typically Oracle Application Server / WebLogic front-ending the E-Business Suite forms and OA Framework pages). The vendor did not assign a CWE (CWE: N/A), but the community tag 'Authentication Bypass' combined with the CVSS confidentiality-only, scope-change profile is consistent with a broken access control or authorization weakness (CWE-284/CWE-863 class) that lets an authenticated user read data outside their intended authorization boundary. The scope change (S:C) indicates the vulnerable CTO component can be used as a pivot to reach data or resources governed by a different security authority within the integrated EBS suite.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update per the advisory at https://www.oracle.com/security-alerts/cpujul2026.html; the CPU is the vendor-released patch mechanism for EBS 12.2.x and is the primary remediation (Patch available per vendor advisory - an exact standalone fix version is not enumerated in the provided data, so identify the specific CTO patch number from the CPU matrix for your 12.2.x level). As compensating controls until patched, restrict network access to the E-Business Suite web tier and specifically to the Configure to Order / Supply to Order Workbench URLs so only trusted internal users reach them (trade-off: may block legitimate remote or partner CTO users); tighten EBS responsibility and function-security grants so low-privileged accounts cannot reach the Supply to Order Workbench (trade-off: requires responsibility-matrix review and may disrupt some order-management workflows); and place the EBS front end behind a reverse proxy or WAF with monitoring on the affected endpoints (trade-off: rules must be tuned to avoid breaking OA Framework requests). Because impact is confidentiality-only, prioritize protecting and auditing access to sensitive order/supply data.