What is the CVSS score of CVE-2026-61271?

CVE-2026-61271 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-61271?

Oracle E-Business Suite versions 12.2.3-12.2.15 contain an unauthenticated remote vulnerability in the Document Management module allowing unauthorized data access and manipulation, with no vendor…

How to fix or mitigate CVE-2026-61271?

Within 24 hours: identify and inventory all EBS instances running versions 12.2.3-12.2.15, document their network exposure, and implement network segmentation restricting Attachments component access to authorized users and systems only. Within 7 days: deploy Web Application Firewall rules to block suspicious API requests to the module, enable comprehensive audit logging on all document operations with automated alerting for bulk reads or mass deletions, and implement rate-limiting on HTTP requests to the Attachments component. Within 30 days: establish weekly vendor contact cadence with Oracle Support to track patch availability and ETA, prepare a staged patching plan including test environment validation for each affected release, and conduct tabletop exercises for incident response scenarios involving unauthorized document access.

Oracle E-Business Suite CVE-2026-61271

EUVD-2026-47455 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-4g9m-p6p6-252w

Authentication Bypass Denial Of Service Oracle Document Management And Collaboration

7.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.3 HIGH

HTTP-reachable and unauthenticated (AV:N/AC:L/PR:N/UI:N) per vendor description, with only partial data read/write and partial DoS, so C/I/A all Low and scope Unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:01 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.3

DescriptionCVE.org

Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Document Management and Collaboration. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Document Management and Collaboration accessible data as well as unauthorized read access to a subset of Oracle Document Management and Collaboration accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Document Management and Collaboration. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Unauthorized data access and partial denial of service in Oracle E-Business Suite's Document Management and Collaboration module (Attachments component) allows a remote unauthenticated attacker to read, insert, update, or delete a subset of application data over HTTP. Affecting supported EBS releases 12.2.3 through 12.2.15, the flaw is rated CVSS 7.3 and is described by Oracle as easily exploitable, requiring no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, unauthenticated network vector makes it a meaningful patching priority in a product family that has been a repeated target of mass-exploitation campaigns.

Technical ContextAI

Oracle E-Business Suite is a large integrated ERP/CRM application stack; the affected functionality is the Document Management and Collaboration product and specifically its Attachments component, which handles file/document attachment and retrieval workflows exposed through the EBS web tier (HTTP). Because the vector is AV:N over HTTP with PR:N, the vulnerable code path is reachable pre-authentication through an internet- or intranet-facing EBS servlet/endpoint. Oracle's CPU does not publish a CWE (CWE is listed as N/A here), but the described effect - an unauthenticated actor gaining limited read plus insert/update/delete access to Attachments data - is consistent with a broken access control / missing authorization class of flaw (CWE-862/CWE-284 family) rather than memory corruption, since the impacts are data-scoped and only partial (C:L/I:L/A:L) with no scope change.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor-released patch source for CVE-2026-61271; the input does not enumerate a discrete fixed build number, so apply the EBS 12.2 CPU patch level that maps to your 12.2.3-12.2.15 release per the July 2026 CPU patch matrix (Patch available per vendor advisory). Until patched, reduce exposure by removing direct internet reachability of the EBS web tier and placing it behind a VPN or reverse proxy with authentication, and restrict/allow-list access to the Document Management, Collaboration, and Attachments URLs at the load balancer or WAF; note that URL restrictions on attachment endpoints can break legitimate document upload/download for end users and integrations, so validate business workflows before enforcing. Given Oracle EBS's history of mass exploitation, also review web-tier access logs for anomalous unauthenticated requests to attachment endpoints.