Skip to main content

Oracle EBS CVE-2026-61139

| EUVDEUVD-2026-61324 MEDIUM
Improper Access Control (CWE-284)
2026-08-18 secalert_us@oracle.com GHSA-38v9-6j86-j9rf
Authentication Bypass Denial Of Service Oracle Public Sector Financials
6.3
CVSS 3.1 · Vendor: oracle
Share

Severity by source

Vendor (oracle) PRIMARY
6.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
vuln.today AI
6.3 MEDIUM

Network-accessible HTTP vector with no complexity; PR:L confirmed as low-privileged account required; partial CIA all warranted by description; scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

1
Analysis Generated
Aug 19, 2026 - 05:47 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Authorization). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Financials (International). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Public Sector Financials (International) accessible data as well as unauthorized read access to a subset of Oracle Public Sector Financials (International) accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Public Sector Financials (International). CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Authorization bypass in Oracle Public Sector Financials (International) - a government-focused module of Oracle E-Business Suite versions 12.2.3 through 12.2.15 - permits low-privileged, network-authenticated attackers to read sensitive financial records, perform unauthorized data manipulation (insert, update, delete), and cause a partial denial of service against the affected module via standard HTTP. Oracle disclosed this in the August 2026 Critical Security Patch Update; no public exploit code has been identified and the vulnerability is not listed in CISA KEV at the time of analysis. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation A valid low-privileged Oracle E-Business Suite application account is required - unauthenticated exploitation is not possible per the CVSS PR:L metric. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) places this at 6.3 - Medium. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply Oracle's August 2026 Critical Security Patch Update (CPU), available at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Public Sector Financials

View all
CVE-2026-62478 HIGH
8.8 Jul 21

Account takeover in Oracle Public Sector Financials (a module of Oracle E-Business Suite, Internal Operations component)
CVE-2021-2363 HIGH
8.1 Jul 21

Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Auth
CVE-2026-60931 HIGH
7.5 Jul 21

Full compromise of Oracle Public Sector Financials (a module of Oracle E-Business Suite, Internal Operations component)

CVE-2026-60927 HIGH
7.5 Jul 21

Full compromise (takeover) of the Oracle Public Sector Financials module in Oracle E-Business Suite 12.2.3 through 12.2.
CVE-2026-62480 MEDIUM
6.5 Jul 21

Unauthorized read access to all data within Oracle Public Sector Financials (E-Business Suite versions 12.2.3-12.2.15) i
CVE-2026-62479 MEDIUM
5.4 Jul 21

Oracle Public Sector Financials (E-Business Suite component: Internal Operations) versions 12.2.3 through 12.2.15 allows
CVE-2026-62482 MEDIUM
5.4 Jul 21

Unauthorized data access in Oracle Public Sector Financials (component: Internal Operations) within Oracle E-Business Su
CVE-2026-60930 LOW
3.1 Jul 21

Partial unauthorized read access in Oracle Public Sector Financials (E-Business Suite, Internal Operations component) ve
CVE-2026-60929 LOW
3.1 Jul 21

Unauthorized data manipulation in Oracle Public Sector Financials (E-Business Suite versions 12.2.3 through 12.2.15) is

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-61139 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy