What is the CVSS score of CVE-2026-61141?

CVE-2026-61141 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Advanced Benefits are affected by CVE-2026-61141?

Oracle Advanced Benefits module in E-Business Suite 12.2.7-12.2.15 can be fully compromised by any authenticated user, disabling critical ACA compliance and benefits administration capabilities.

How to fix or mitigate CVE-2026-61141?

Within 24 hours: Restrict authentication to the Advanced Benefits module to only essential personnel; disable unnecessary user accounts; contact your Oracle Account Manager for patch timelines and interim guidance. Within 7 days: Deploy Web Application Firewall rules to detect and block crafted HTTP requests targeting the module; implement enhanced monitoring and audit logging of all Advanced Benefits transactions. Within 30 days: Upon Oracle's release of a patch for affected versions (12.2.7-12.2.15), deploy immediately; validate module functionality in a staging environment before production rollout.

Oracle Advanced Benefits CVE-2026-61141

EUVD-2026-47349 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-ww93-2cgf-gw86

Privilege Escalation Oracle Advanced Benefits

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network HTTP reach (AV:N) by an authenticated low-privilege user (PR:L), with high complexity (AC:H) preconditions; full module takeover justifies C:H/I:H/A:H and S:U.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:35 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Affordable Care Act). Supported versions that are affected are 12.2.7-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Benefits. Successful attacks of this vulnerability can result in takeover of Oracle Advanced Benefits. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of the Oracle Advanced Benefits module (Affordable Care Act component) within Oracle E-Business Suite 12.2.7 through 12.2.15 is possible by a low-privileged, authenticated attacker sending crafted HTTP requests over the network. Successful exploitation yields complete takeover of the module with high confidentiality, integrity, and availability impact. This is a July 2026 Oracle Critical Patch Update issue with no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

Oracle Advanced Benefits (OAB) is a benefits administration module of the Oracle E-Business Suite (EBS) HCM stack, and the affected code sits in its Affordable Care Act (ACA) component, which handles US employer healthcare compliance reporting. EBS is a large web-based ERP platform typically fronted by Oracle HTTP Server / WebLogic and accessed over HTTP, which aligns with the network attack vector. No CWE was assigned by NVD, so the precise root-cause class is not confirmed; the vendor tag 'Information Disclosure' hints at data exposure, but the CVSS vector's high integrity and availability impacts indicate the flaw goes beyond mere disclosure to full module compromise, suggesting an authorization/access-control or injection weakness in the ACA feature reachable by authenticated application users.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update as documented at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle delivers EBS 12.2 fixes as cumulative CPU patches applied on top of the 12.2.x codelevel, so identify and install the specific OAB/ACA patch listed in that CPU for your running 12.2.7-12.2.15 level (no standalone fixed version string was provided in the input, so do not assume a version number - pull the exact patch ID from the CPU). Until patched, reduce exposure by restricting network access to the Oracle Advanced Benefits and ACA self-service/administration pages to trusted internal networks or VPN, limiting and reviewing which authenticated accounts have OAB responsibilities (since PR:L means an authenticated low-privileged user is the threat), and increasing monitoring/WAF inspection of HTTP traffic to the affected EBS functions; note these controls can disrupt legitimate benefits-administration workflows and ACA reporting cycles and are stopgaps, not substitutes for the CPU patch.