What is the CVSS score of CVE-2026-61249?

CVE-2026-61249 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Oracle Learning Management CVE-2026-61249

EUVD-2026-47438 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-hc2h-jpjg-4986

Authentication Bypass Information Disclosure Oracle Learning Management

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable over HTTP, low complexity; PR:L reflects required low-privilege account; C:H for complete LMS data disclosure; no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:12 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Import And Export). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Learning Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Learning Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Learning Management (E-Business Suite) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to access critical or complete LMS data via the Import and Export component over HTTP. Tagged as an Authentication Bypass, the flaw enables privilege escalation beyond the attacker's granted access level, resulting in full confidentiality compromise of all Learning Management accessible data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network vector make this straightforward to exploit once credentials are obtained.

Technical ContextAI

Oracle Learning Management is a module of Oracle E-Business Suite (EBS), an enterprise resource planning platform widely used for HR and compliance training in large organizations. The vulnerable component is Import and Export - functionality typically used for bulk data operations such as course content, user records, or completion data. The 'Authentication Bypass' tag, combined with a PR:L CVSS vector, indicates that while basic authentication is required, the flaw allows a low-privileged user to circumvent access control logic and read data beyond their authorization scope. No CWE was assigned in the source data, but the behavior pattern is consistent with broken object-level authorization (BOLA/IDOR) or missing function-level access control within the Import/Export workflow. Affected CPE covers Oracle E-Business Suite versions 12.2.3 through 12.2.15.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, referenced at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability. The exact patched version number is not independently confirmed from the available advisory data - consult the full CPU matrix to identify the specific patch set applicable to your EBS installation. As a compensating control prior to patching, restrict network access to the Oracle EBS Import and Export component via application-layer firewall rules or EBS function security to limit which user responsibilities can invoke this functionality; note this may impact legitimate bulk data workflows. Additionally, review and tighten EBS role assignments for the Learning Management module to ensure only authorized administrators hold access to Import/Export operations, reducing the pool of accounts that could be leveraged in exploitation. No workaround is confirmed as equivalent to patching.