What is the CVSS score of CVE-2026-61266?

CVE-2026-61266 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Supply Chain Globalization CVE-2026-61266

EUVD-2026-47452 MEDIUM

SQL Injection (CWE-89)

2026-07-21 secalert_us@oracle.com

GHSA-q9fg-x884-7m93

Denial Of Service SQLi Oracle E Business Suite

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Vendor-supplied vector is consistent with the description: low-privileged HTTP access with partial CIA impacts and no scope change, warranting no adjustments.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:07 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Supply Chain Globalization product of Oracle E-Business Suite (component: Copy Inventory Organization). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Supply Chain Globalization. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Supply Chain Globalization accessible data as well as unauthorized read access to a subset of Oracle Supply Chain Globalization accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Supply Chain Globalization. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Partial data compromise and denial of service in Oracle Supply Chain Globalization (Oracle E-Business Suite) allows low-privileged authenticated attackers over HTTP to perform unauthorized read, write, and partial availability impacts against the Copy Inventory Organization component. Affected versions span 12.2.3 through 12.2.15, covering a broad range of the E-Business Suite 12.2 release train. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the category of a credible but not actively weaponized medium-severity vulnerability.

Technical ContextAI

Oracle E-Business Suite (EBS) is a comprehensive enterprise resource planning platform. The Supply Chain Globalization module within EBS manages cross-border inventory and logistics operations, and the Copy Inventory Organization component specifically handles duplication of inventory org structures. The flaw resides in the HTTP-accessible interface of this component, permitting low-privileged users to interact with it in unintended ways. The CWE classification was not provided by the vendor, so the precise root cause class - whether improper authorization, insufficient access control, or input validation failure - cannot be confirmed from available data. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates a straightforward, low-complexity network attack requiring only a basic authenticated session, with all impacts constrained to low severity and no scope change.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability in Oracle E-Business Suite. The exact patched version is not independently specified in the available data beyond the CPU reference - organizations should consult the July 2026 CPU documentation for precise patch identifiers and installation instructions. As a compensating control prior to patching, administrators may consider restricting network access to the Copy Inventory Organization component of Supply Chain Globalization to only those user roles that legitimately require it, reducing exposure to low-privileged internal accounts. Note that tightening role-based access controls within EBS may require testing to avoid disrupting legitimate supply chain workflows.