What is the CVSS score of CVE-2026-61274?

CVE-2026-61274 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Oracle Product Hub CVE-2026-61274

EUVD-2026-47456 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-gjxv-qvc2-54h6

Authentication Bypass Denial Of Service Oracle Product Hub

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Vendor-supplied vector is consistent with description: network-accessible HTTP endpoint, low complexity, low-privileged account required, no interaction, partial CIA impacts scoped to Product Hub only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:07 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Product Hub accessible data as well as unauthorized read access to a subset of Oracle Product Hub accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Product Hub. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Oracle Product Hub's Item Catalog component in E-Business Suite versions 12.2.3 through 12.2.15 exposes an easily exploitable flaw allowing low-privileged, authenticated HTTP network attackers to compromise item master data. Successful exploitation yields unauthorized read access to a subset of Product Hub data, unauthorized data modification or deletion, and partial denial of service against the Product Hub component. No public exploit identified at time of analysis, and Oracle classified this as 'easily exploitable' in its July 2026 Critical Patch Update.

Technical ContextAI

Oracle E-Business Suite (EBS) is Oracle's integrated ERP platform; Oracle Product Hub is the master data management module within EBS responsible for item catalog governance and product information management. The affected component is the Item Catalog, which manages product master records accessible via HTTP through the EBS web tier. The CVSS vector (AV:N/AC:L/PR:L) indicates the vulnerability resides in an HTTP-accessible endpoint requiring only a valid low-privileged session, consistent with an authorization or access-control weakness in the Item Catalog's request handling. No CWE identifier was provided, so the specific root-cause class - whether improper authorization, insufficient input validation, or another weakness category - is unconfirmed from available intelligence.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU), which addresses CVE-2026-61274 for Oracle Product Hub versions 12.2.3 through 12.2.15; the advisory is available at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched release version is not independently confirmed from available references beyond the CPU advisory URL - consult My Oracle Support for the specific patch bundle applicable to your EBS instance. Where immediate patching is not feasible, enforce least-privilege access controls on EBS user accounts to limit who holds access to the Product Hub Item Catalog component, reducing the pool of potential attackers to those with a legitimate business need. Additionally, restrict network-level access to the EBS web tier to trusted internal networks or VPN-connected clients, which raises the effective attack bar despite the PR:L requirement. Note that restricting Item Catalog access will impact legitimate product data stewards and may require role-based exception handling.