EUVD-2026-61327
GHSA-65x5-q4qm-w5m3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-accessible HTTP endpoint bypasses authentication without user interaction; confidentiality and integrity partially impacted, no availability impact documented per description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Learning Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Learning Management accessible data as well as unauthorized read access to a subset of Oracle Learning Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
AnalysisAI
Unauthenticated remote access to Oracle Learning Management (E-Business Suite versions 12.2.3 through 12.2.15) enables attackers to read, insert, update, or delete subsets of application data via HTTP without any credentials. Tagged as an authentication bypass in the Internal Operations component, this vulnerability exposes organizations running these specific EBS versions to unauthorized data manipulation affecting confidentiality and integrity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of Oracle Learning Management in E-Business Suite versions 12.2.3 through 12.2.15 over HTTP. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N indicates a medium-severity vulnerability with an attacker-favorable exploitation profile: no authentication, no user interaction, and low attack complexity over HTTP. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Oracle's Critical Patch Update issued in August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html, which addresses this vulnerability across Oracle Learning Management 12.2.3 through 12.2.15. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Learning Management
View allVulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: OTA Training Activities).
Data compromise in Oracle Learning Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 t
Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Setup). Rated high severi
Data compromise in Oracle Learning Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 t
Unauthorized data disclosure in Oracle Learning Management (E-Business Suite) versions 12.2.3 through 12.2.15 allows a l
Import and Export component exploitation in Oracle Learning Management (Oracle E-Business Suite 12.2.3-12.2.15) allows a
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today