What is the CVSS score of CVE-2026-61262?

CVE-2026-61262 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Oracle Teleservice CVE-2026-61262

EUVD-2026-47449 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-qxm9-4f85-jf39

Authentication Bypass Oracle E Business Suite

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible unauthenticated HTTP endpoint with partial data read and write impact, no availability effect, and no scope change supports the vendor-provided vector without revision.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:08 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Teleservice product of Oracle E-Business Suite (component: Service Diagnostics Scripts). Supported versions that are affected are 12.2.3-12.215. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Teleservice. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Teleservice accessible data as well as unauthorized read access to a subset of Oracle Teleservice accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Unauthenticated remote exploitation of Oracle Teleservice (E-Business Suite versions 12.2.3 through 12.2.15) via HTTP allows attackers to read a subset of accessible service data and perform unauthorized insert, update, or delete operations against Teleservice records through the Service Diagnostics Scripts component. The vulnerability is tagged as an authentication bypass, indicating the diagnostic scripting interface fails to enforce access controls against unauthenticated callers. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, though Oracle's own advisory classifies this as 'easily exploitable,' elevating operational priority for internet-facing EBS deployments.

Technical ContextAI

Oracle Teleservice is a customer service management module within Oracle E-Business Suite (EBS), Oracle's flagship enterprise resource planning suite. The affected subcomponent, Service Diagnostics Scripts, is a diagnostic or administrative scripting interface embedded within the Teleservice module. The CVSS vector AV:N/AC:L/PR:N/UI:N reflects an HTTP-accessible endpoint requiring no credentials, no special configuration, and no user interaction. The vulnerability is tagged 'Authentication Bypass,' indicating the root cause is a missing or improperly enforced authentication gate on the Service Diagnostics Scripts endpoint - a class of flaw often manifesting as an exposed administrative API or diagnostic servlet reachable without session validation. No CWE identifier was provided by the reporter, so formal root-cause classification beyond the authentication bypass tag is unavailable. Affected versions span Oracle EBS 12.2.3 through 12.2.15, as confirmed by Oracle CPU July 2026 and corroborated by EUVD-2026-47449.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, documented at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses CVE-2026-61262 for Oracle Teleservice. The CPU advisory should be consulted for the specific patch identifier and installation instructions applicable to the installed EBS version. Note that the exact patched release version is not independently confirmed beyond the CPU advisory reference - organizations should validate patch applicability directly with Oracle support. As an interim compensating control, restrict network access to the Service Diagnostics Scripts component via perimeter firewall or web application firewall rules, limiting HTTP reachability to the Oracle EBS application tier from trusted internal IP ranges only. Additionally, Oracle E-Business Suite's function security framework can be used to restrict access to the affected diagnostic functionality at the application layer, though the effectiveness of this control against an authentication bypass depends on whether the bypass circumvents function security enforcement. Network-level segmentation carries no functional trade-off for most deployments; application-layer restriction should be tested for impact on legitimate diagnostic workflows.