What is the CVSS score of CVE-2026-61218?

CVE-2026-61218 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-61218?

Oracle E-Business Suite versions 12.2.3 through 12.2.15 contain a data compromise vulnerability in the Secure Enterprise Search component that allows low-privilege authenticated attackers to read,…

How to fix or mitigate CVE-2026-61218?

Within 24 hours, identify all Oracle EBS instances running versions 12.2.3 through 12.2.15 and document their deployment locations, user bases, and connected data assets. Within 7 days, implement compensating controls by restricting network access to EBS environments, limiting authenticated users to only those requiring Secure Enterprise Search functionality, and enabling comprehensive audit logging for all search component activities. Within 30 days, contact Oracle Support for patch availability and develop an upgrade or remediation plan; if upgrades are available, prioritize systems containing sensitive data for immediate patching.

Oracle E-Business Suite CVE-2026-61218

EUVD-2026-47417 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-8m7x-ff2h-c6rr

Authentication Bypass Oracle E Business Suite Secure Enterprise Search

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Remote HTTP exploitation with low complexity by an authenticated low-privilege user (PR:L); full read/write to SES data but no availability loss, so C:H/I:H/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:10 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle E-Business Suite Secure Enterprise Search product of Oracle E-Business Suite (component: Search Integration Engine). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Secure Enterprise Search. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle E-Business Suite Secure Enterprise Search accessible data as well as unauthorized access to critical data or complete access to all Oracle E-Business Suite Secure Enterprise Search accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Broad data compromise in Oracle E-Business Suite Secure Enterprise Search (Search Integration Engine) affects EBS versions 12.2.3 through 12.2.15, where a network attacker with only low-level authenticated access over HTTP can read, create, modify, or delete all data accessible to the Secure Enterprise Search component. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N) rates it 8.1 High, reflecting low attack complexity and full confidentiality and integrity impact without availability loss. No public exploit identified at time of analysis, though the vendor's 'Authentication Bypass' tagging suggests weak access-control enforcement in the affected component.

Technical ContextAI

Oracle E-Business Suite is a large ERP application stack, and Secure Enterprise Search (SES) is its integrated search subsystem that indexes and returns records across EBS modules. The vulnerable element is the Search Integration Engine, the middleware that mediates search queries against back-end EBS data. Oracle does not assign a CWE here (CWE: N/A), but the 'Authentication Bypass' tag combined with the PR:L / C:H / I:H profile points to a broken access-control or authorization-check class of flaw (conceptually CWE-285/CWE-287), where an already-authenticated low-privilege user can reach data and operations that should require higher privilege. No CPE strings were supplied in the input, so exact platform CPEs cannot be enumerated beyond the EUVD version range.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, which contains the fix for this CVE, per the advisory at https://www.oracle.com/security-alerts/cpujul2026.html; Patch available per vendor advisory, but no discrete fix version string was published in the input beyond the CPU bundle, so administrators should map their EBS 12.2.x level to the corresponding CPU patch in My Oracle Support. As compensating controls until patching, restrict network reachability of the Secure Enterprise Search endpoints to trusted internal segments or behind a VPN/reverse proxy to reduce HTTP exposure, tighten provisioning of low-privilege EBS accounts and review who holds SES access, and increase monitoring/auditing of SES query and data-modification activity to detect abuse; note these controls reduce exposure but do not remove the underlying authorization flaw and may disrupt legitimate search users if access is over-restricted.