What is the CVSS score of CVE-2026-61261?

CVE-2026-61261 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Knowledge Management CVE-2026-61261

EUVD-2026-47448 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-w9p5-4pc3-95wr

Authentication Bypass Oracle Knowledge Management

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-accessible HTTP interface with low privilege required aligns with PR:L; partial read and write impact confirmed; no availability impact observed.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:09 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Knowledge Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Knowledge Management accessible data as well as unauthorized read access to a subset of Oracle Knowledge Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Unauthorized data access in Oracle Knowledge Management (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged attacker over HTTP without user interaction. Exploitation allows unauthorized read access to a subset of Knowledge Management data and unauthorized insert, update, or delete operations against accessible data records. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, though the 'Authentication Bypass' tag warrants scrutiny given the CVSS PR:L rating.

Technical ContextAI

Oracle Knowledge Management is the User Interface component of Oracle E-Business Suite (EBS), a comprehensive enterprise resource planning and customer management platform. The vulnerability resides in the HTTP-accessible User Interface tier, exploitable over a standard network path (AV:N). No CWE identifier was assigned by the reporter, limiting root-cause classification to inference. However, the 'Authentication Bypass' tag applied by intelligence sources suggests the flaw may involve improper authorization enforcement within the UI layer - potentially allowing a low-privilege authenticated session to access or manipulate data objects normally restricted to higher-privilege roles. This is consistent with broken object-level authorization (BOLA/IDOR) or insufficient access control checks in UI endpoints. The affected CPE range spans Oracle EBS Knowledge Management 12.2.3 through 12.2.15, a broad version band covering several years of deployment.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, available via the Oracle Security Alerts page at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPUs bundle patches for all affected products; administrators should identify the specific patch for Oracle E-Business Suite Knowledge Management and apply it according to Oracle's patching procedures. An exact standalone fix version number is not independently confirmed from the available data - the patch is delivered through Oracle's standard CPU mechanism. As a compensating control prior to patching, restrict network access to Oracle EBS User Interface endpoints to only trusted internal IP ranges or VPN-authenticated users, reducing the attack surface by limiting who can reach the HTTP interface. Additionally, review EBS role assignments to ensure the principle of least privilege is enforced - limiting which user accounts hold any Knowledge Management write permissions reduces the impact window. Note that restricting UI network access may affect remote users who legitimately access EBS; weigh this trade-off against organizational risk tolerance.