What is the CVSS score of CVE-2026-61271?

CVE-2026-61271 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-61271?

Within 24 hours: identify and inventory all EBS instances running versions 12.2.3-12.2.15, document their network exposure, and implement network segmentation restricting Attachments component access to authorized users and systems only. Within 7 days: deploy Web Application Firewall rules to block suspicious API requests to the module, enable comprehensive audit logging on all document operations with automated alerting for bulk reads or mass deletions, and implement rate-limiting on HTTP requests to the Attachments component. Within 30 days: establish weekly vendor contact cadence with Oracle Support to track patch availability and ETA, prepare a staged patching plan including test environment validation for each affected release, and conduct tabletop exercises for incident response scenarios involving unauthorized document access.

Oracle E-Business Suite CVE-2026-61271

EUVD-2026-47455 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-4g9m-p6p6-252w

Authentication Bypass Denial Of Service Oracle Document Management And Collaboration

7.3

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach exposed EBS web tier
Delivery

Send crafted HTTP request to Attachments endpoint
Exploit

Bypass authorization on Document Management module
Execution

Read subset and insert/update/delete attachment data
Impact

Trigger partial denial of service

Vulnerability Assessment

Weakness	CWE CWE-284 MITRE ATT&CK 1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions beyond network reachability - remote unauthenticated exploitation (PR:N/UI:N/AC:L) over HTTP against supported Oracle E-Business Suite 12.2.3-12.2.15 deployments running the Document Management and Collaboration product with the Attachments component exposed. Exploitation is limited to environments where the EBS web tier and its attachment endpoints are network-accessible to the attacker; organizations that keep EBS off the public internet or behind authenticated proxies materially reduce reachability. Impact is inherently bounded (partial read of a data subset, partial insert/update/delete, and only partial DoS), so the condition of concern is exposure of the endpoint rather than any special product feature toggle or non-default configuration named in the advisory.
Impact	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, base 7.3 High) signals a genuinely low-barrier attack: network-reachable, low complexity, no privileges, no user interaction. The counterweight is that all three impacts are Low and scope is Unchanged - the attacker gets partial read and partial write/delete to a subset of Attachments data and can cause only a partial DoS, not full compromise or code execution. No EPSS score, SSVC decision, KEV entry, or public POC was provided in the input, so exploitation is currently 'no public exploit identified at time of analysis'; do not treat this as actively exploited. Net: this is a legitimate priority-to-patch because unauthenticated internet-facing EBS endpoints are attractive and Oracle explicitly calls it 'easily exploitable,' but the bounded (partial) impact places it below RCE-class EBS bugs. Missing signals (EPSS/SSVC/POC status) mean urgency should be driven by internet exposure of the EBS web tier rather than confirmed in-the-wild activity.
Exploit ScenarioDerived	An attacker who can reach an internet- or intranet-exposed Oracle EBS web tier sends a crafted HTTP request to the Attachments endpoint of Document Management and Collaboration and, without any credentials, reads a subset of attachment data and inserts, modifies, or deletes some records, or floods the component to cause a partial denial of service. No public exploit code has been identified at time of analysis, but Oracle rates the issue easily exploitable given the low-complexity, no-authentication vector (AC:L/PR:N/UI:N).

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Unauthorized data access and partial denial of service in Oracle E-Business Suite's Document Management and Collaboration module (Attachments component) allows a remote unauthenticated attacker to read, insert, update, or delete a subset of application data over HTTP. Affecting supported EBS releases 12.2.3 through 12.2.15, the flaw is rated CVSS 7.3 and is described by Oracle as easily exploitable, requiring no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, unauthenticated network vector makes it a meaningful patching priority in a product family that has been a repeated target of mass-exploitation campaigns.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor-released patch source for CVE-2026-61271; the input does not enumerate a discrete fixed build number, so apply the EBS 12.2 CPU patch level that maps to your 12.2.3-12.2.15 release per the July 2026 CPU patch matrix (Patch available per vendor advisory). Until patched, reduce exposure by removing direct internet reachability of the EBS web tier and placing it behind a VPN or reverse proxy with authentication, and restrict/allow-list access to the Document Management, Collaboration, and Attachments URLs at the load balancer or WAF; note that URL restrictions on attachment endpoints can break legitimate document upload/download for end users and integrations, so validate business workflows before enforcing. Given Oracle EBS's history of mass exploitation, also review web-tier access logs for anomalous unauthenticated requests to attachment endpoints.

Affected VersionsENISA

Oracle Document Management and Collaboration 12.2.3 ≤12.2.15

Affected Packages

euvd oracle_document_management_and_collaboration no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle E-Business Suite is a large integrated ERP/CRM application stack; the affected functionality is the Document Management and Collaboration product and specifically its Attachments component, which handles file/document attachment and retrieval workflows exposed through the EBS web tier (HTTP). Because the vector is AV:N over HTTP with PR:N, the vulnerable code path is reachable pre-authentication through an internet- or intranet-facing EBS servlet/endpoint. Oracle's CPU does not publish a CWE (CWE is listed as N/A here), but the described effect - an unauthenticated actor gaining limited read plus insert/update/delete access to Attachments data - is consistent with a broken access control / missing authorization class of flaw (CWE-862/CWE-284 family) rather than memory corruption, since the impacts are data-scoped and only partial (C:L/I:L/A:L) with no scope change.

Know when Document Management And Collaboration gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI 7.3 HIGH

HTTP-reachable and unauthenticated (AV:N/AC:L/PR:N/UI:N) per vendor description, with only partial data read/write and partial DoS, so C/I/A all Low and scope Unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

DescriptionCVE.org

Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Document Management and Collaboration. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Document Management and Collaboration accessible data as well as unauthorized read access to a subset of Oracle Document Management and Collaboration accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Document Management and Collaboration. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

Executive ViewAI

Why It Matters

Oracle E-Business Suite versions 12.2.3-12.2.15 contain an unauthenticated remote vulnerability in the Document Management module allowing unauthorized data access and manipulation, with no vendor patch currently available. The low-complexity network attack vector and widespread use of EBS for financial and procurement data create substantial risk to data confidentiality and integrity. Organizations running affected versions require immediate compensating controls and vendor patch readiness.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Implement network segmentation limiting Attachments component access by IP whitelist and role-based restrictions; deploy WAF rules to block malformed or suspicious Attachments API payloads; enable enhanced audit logging with real-time alerting on document mass-read, mass-update, or mass-delete operations; restrict affected EBS instances from untrusted network segments; and evaluate temporary disabling of Attachments functionality if business processes permit until patch is available.

Threat Intelligence Overview

EPSS Score

0.3%

Top 77% exploitable

Prevalence

High

widely-deployed enterprise ERP suite in large organizations

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.