What is the CVSS score of CVE-2026-61138?

CVE-2026-61138 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-61138?

A vulnerability in Oracle E-Business Suite CMRO module (versions 12.2.3-12.2.15) allows unauthenticated remote attackers to read confidential financial and operational data, with no vendor patch…

How to fix or mitigate CVE-2026-61138?

Within 24 hours, inventory all E-Business Suite 12.2.3-12.2.15 deployments and confirm CMRO exposure; contact Oracle support immediately for interim mitigation guidance. Within 7 days, implement network-layer access controls restricting HTTP access to CMRO Internal Operations to trusted networks only, deploy IDS/IPS signatures to detect abnormal CMRO queries, and enable detailed logging and alerting on CMRO data access patterns. Within 30 days, establish a testing plan for vendor patches when released, apply patches immediately post-validation, and conduct a forensic data access audit to identify any evidence of unauthorized disclosure.

Oracle E-Business Suite CVE-2026-61138

EUVD-2026-47347 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-m4f7-5v6r-8c8c

Authentication Bypass Oracle Complex Maintenance Repair And Overhaul

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network HTTP access (AV:N/PR:N/UI:N) but vendor-rated difficult, so AC:H; scope change (S:C) with high read exposure (C:H), limited writes (I:L), no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:37 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Complex Maintenance, Repair and Overhaul. While the vulnerability is in Oracle Complex Maintenance, Repair and Overhaul, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Complex Maintenance, Repair and Overhaul accessible data as well as unauthorized update, insert or delete access to some of Oracle Complex Maintenance, Repair and Overhaul accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Complex Maintenance, Repair and Overhaul (CMRO), a module of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a remote unauthenticated attacker abuse the Internal Operations component over HTTP to read critical CMRO data and make limited unauthorized modifications. Because the flaw carries a scope change, a successful attack can significantly impact products beyond CMRO itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 with high attack complexity, so exploitation is rated difficult.

Technical ContextAI

Oracle CMRO is an asset-intensive maintenance and overhaul application delivered as a component of the Oracle E-Business Suite (EBS) 12.2 application stack, which runs on an Oracle Application Server / WebLogic middle tier and Oracle Database backend and exposes servlet-based web endpoints. The affected surface is the 'Internal Operations' component reached over HTTP. Oracle does not publish a CWE for its CPU advisories (CWE is N/A here), so the precise weakness class is not formally categorized, but the vendor-supplied tag 'Authentication Bypass' combined with PR:N in the CVSS vector points to a flaw that lets an unauthenticated request reach and read data that should require a session. The scope-change flag (S:C in CVSS 3.1) indicates the vulnerable component can affect resources managed by a different security authority, consistent with EBS's shared middle tier where one module's flaw can expose data owned by adjacent modules.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships CMRO/EBS security fixes as CPU patch bundles rather than a single named product release, so this is patch available per vendor advisory and administrators should map the specific CMRO/EBS 12.2 patch for their installed version (12.2.3-12.2.15) from that advisory rather than relying on an invented version number. Until the CPU is applied, reduce exposure by restricting network reachability of the CMRO Internal Operations web endpoints - for example limit HTTP access to the EBS application tier to trusted networks or place it behind a VPN or reverse proxy with access-control lists, and block external access to the CMRO servlet paths if the module is deployed but not needed externally; the trade-off is that legitimate remote or partner users of CMRO Internal Operations lose direct access and may require VPN onboarding. Because the flaw has a scope change, also review logging and monitoring on adjacent EBS modules for anomalous data access while the patch is pending.