What is the CVSS score of CVE-2026-61269?

CVE-2026-61269 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Oracle Product Workbench CVE-2026-61269

EUVD-2026-47454 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-jgvc-cgcw-mmpw

Authentication Bypass Denial Of Service Oracle Product Workbench

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Network-accessible WebUI requiring low-privileged authentication (PR:L), low complexity, no interaction, no scope change, with partial confidentiality, integrity, and availability impact consistent with the advisory description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:07 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Workbench. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Product Workbench accessible data as well as unauthorized read access to a subset of Oracle Product Workbench accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Product Workbench. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Oracle Product Workbench's WebUI component within E-Business Suite versions 12.2.3 through 12.2.15 allows low-privileged authenticated attackers reachable over HTTP to perform unauthorized data reads, inserts, updates, and deletions against accessible product data, and to cause partial denial of service. Oracle's CPU July 2026 advisory characterizes the vulnerability as 'easily exploitable,' indicating a low-complexity attack path once valid low-level credentials are obtained. No public exploit code or CISA KEV listing has been identified at time of analysis, placing current exploitation status as unconfirmed.

Technical ContextAI

Oracle Product Workbench is a product data management module within Oracle E-Business Suite (EBS), a broad enterprise resource planning platform. The affected component is the WebUI layer - the HTTP-based web interface used to manage product configurations and data. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) points to a network-accessible flaw requiring no complexity and only low-level privileges, consistent with an improper authorization or access control weakness in how the WebUI validates or enforces permissions on HTTP operations over product data. No CWE classification was provided by Oracle or NVD, so the root cause class cannot be pinpointed from available data. The ENISA EUVD entry (EUVD-2026-47454) corroborates the affected version range as Oracle Product Workbench 12.2.3 through 12.2.15. No CPE strings were included in the provided intelligence.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, which addresses CVE-2026-61269 as documented at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPU patches for E-Business Suite 12.2.x should be applied following Oracle's standard online patching procedures for the AD and TXK patch sets. An exact patched release version was not specified in the available advisory data beyond the CPU July 2026 reference - verify the specific patch number in the CPU advisory matrix before deployment. If immediate patching is not feasible, restrict HTTP access to the Product Workbench WebUI to authenticated, trusted internal users only, enforced at the network perimeter or application firewall level - block external or untrusted network access to the EBS WebUI for this module. Note that this control may impact legitimate remote users relying on the Product Workbench interface and should be coordinated with business stakeholders. Reducing the population of low-privileged EBS accounts with Product Workbench access also narrows the exploitable attack surface.