What is the CVSS score of CVE-2026-61200?

CVE-2026-61200 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Labor Distribution CVE-2026-61200

EUVD-2026-47404 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-4r5v-6p2m-qfm6

Authentication Bypass Oracle E Business Suite

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L confirmed by Oracle description; partial C and I with no A or scope change matches the limited data-access impact described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:15 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Labor Distribution. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Labor Distribution accessible data as well as unauthorized read access to a subset of Oracle Labor Distribution accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Oracle Labor Distribution (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 exposes an authorization bypass in its Internal Operations component, enabling a low-privileged authenticated attacker with network access to read a subset of labor distribution data and perform unauthorized insert, update, or delete operations. The vulnerability is classified as 'easily exploitable' by Oracle with a CVSS 3.1 score of 5.4 (Medium), reflecting low attack complexity and no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis; remediation is available via Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Labor Distribution is a module within Oracle E-Business Suite (EBS), an enterprise resource planning platform widely deployed in large organizations for financial, HR, and payroll functions. The affected component, Internal Operations, handles backend processing of workforce cost allocation and labor charge distribution across cost centers. The tag 'Authentication Bypass' alongside a CVSS vector of PR:L suggests this is not a pre-authentication bypass, but rather an intra-application authorization bypass: an attacker holding minimal EBS credentials can circumvent internal access controls within the Labor Distribution module to access or manipulate data records beyond their assigned scope. No CWE identifier was assigned, so the precise root cause class (e.g., improper authorization, broken access control) cannot be confirmed from available data. Affected CPE is implicitly Oracle E-Business Suite versions 12.2.3 through 12.2.15 based on EUVD-2026-47404 and the Oracle advisory.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability in Oracle Labor Distribution. An exact patched version number was not independently confirmed beyond the Oracle CPU advisory - administrators should consult the Oracle patch matrix for their specific EBS release to identify the applicable patch set. As a compensating control prior to patching, organizations can restrict network access to the Oracle EBS Internal Operations component to trusted internal IP ranges, reducing the exploitable attack surface from the broader network. Additionally, reviewing and tightening Oracle EBS user role assignments to enforce least-privilege - ensuring no accounts have broader Labor Distribution access than operationally required - limits the pool of potential attackers. Note that Oracle EBS patching can require downtime and thorough regression testing; plan maintenance windows accordingly.