What is the CVSS score of CVE-2026-61217?

CVE-2026-61217 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Oracle Security Service CVE-2026-61217

EUVD-2026-47416 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-72xx-fw27-3r85

Oracle Authentication Bypass Security Service

6.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.4 MEDIUM

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

6.4 MEDIUM

Network TLS attack surface with high complexity and required victim interaction (AC:H, UI:R); low privilege needed to initiate; no availability impact described.

3.1 AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:14 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Security Service product of Oracle Fusion Middleware (component: Oracle SSL API). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows low privileged attacker with network access via TLS to compromise Oracle Security Service. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Security Service accessible data as well as unauthorized access to critical data or complete access to all Oracle Security Service accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N).

AnalysisAI

Confidentiality and integrity compromise in Oracle Security Service 12.2.1.4.0 (Oracle SSL API component within Oracle Fusion Middleware) allows a low-privileged, network-connected attacker to gain unauthorized read and write access to critical data managed by the service over TLS. Tagged as an Authentication Bypass by ENISA EUVD (EUVD-2026-47416) and reported by Oracle's security team via the July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 score of 6.4 due to high attack complexity and mandatory human interaction, significantly constraining real-world exploitability. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Oracle Security Service is a core Oracle Fusion Middleware component that provides SSL/TLS cryptographic services through the Oracle SSL API, used broadly across Oracle's middleware product stack for secure communications. The affected version is 12.2.1.4.0. The attack vector is network-based via TLS, indicating that the SSL API itself is the exposed surface. Although no formal CWE is assigned, the 'Authentication Bypass' tag from ENISA EUVD suggests the flaw likely involves improper validation of authentication state or credentials within the TLS negotiation or session management layer of the Oracle SSL API - permitting a low-privileged attacker to effectively escalate their access or impersonate a higher-privileged context. The S:U (unchanged scope) in the CVSS vector confirms the impact is contained within the Oracle Security Service trust boundary. The absence of an Availability impact (A:N) suggests the flaw does not cause crashes or denial of service, focusing solely on data confidentiality and integrity.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU), which addresses this vulnerability for Oracle Fusion Middleware 12.2.1.4.0. The advisory and patch download instructions are available at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched release version number was not specified in the available intelligence - organizations should consult the Oracle CPU advisory directly for patch bundle identifiers and installation guidance. As compensating controls while patching, restrict network access to Oracle Fusion Middleware SSL API endpoints via firewall rules or network segmentation, limiting exposure to trusted internal networks only; this reduces the AV:N attack surface but does not eliminate risk where internal attackers are considered. Additionally, review and enforce the principle of least privilege on accounts with network access to the Oracle Security Service, reducing the pool of users who could serve as the required low-privileged attacker. Note that UI:R is a prerequisite, so monitoring for unusual user activity involving SSL sessions may provide early detection capability.