What is the CVSS score of CVE-2026-61275?

CVE-2026-61275 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Oracle Product Hub CVE-2026-61275

EUVD-2026-47457 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-pwmf-4jwh-xjgw

Authentication Bypass Denial Of Service Oracle Product Hub

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Low-privileged network attacker with no attack requirements beyond credentials; vulnerable system impacts are partial across all three dimensions with no subsequent-system scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:06 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

MEDIUM 6.3

DescriptionCVE.org

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Role Based Security). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Product Hub accessible data as well as unauthorized read access to a subset of Oracle Product Hub accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Product Hub. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Oracle Product Hub versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, exposes a flaw in its Role Based Security component that allows a low-privileged, network-authenticated attacker to exceed their authorized data access via HTTP. Successful exploitation yields unauthorized read access to a subset of product catalog data, unauthorized insert, update, or delete operations on accessible records, and the ability to cause partial denial of service within the Product Hub module. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle disclosed this through the July 2026 Critical Patch Update.

Technical ContextAI

Oracle Product Hub is the master data management layer within Oracle E-Business Suite (EBS) responsible for centralizing and governing enterprise product catalog data. The affected component, Role Based Security, is the authorization enforcement mechanism that governs what data and operations each EBS user role can access within Product Hub. A failure in this enforcement layer - the root cause class is unspecified as no CWE was assigned - allows a user operating under a constrained role to perform actions or access data reserved for higher-privileged roles. The HTTP attack vector points to exploitation through the EBS web application tier, consistent with how EBS is typically accessed via Oracle Application Framework (OAF) or Oracle Forms web interfaces. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U) confirms this is a straightforward network-reachable authorization control flaw requiring no special technical complexity beyond a valid low-privileged session.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU), announced at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publish granular patch version numbers in public CPU advisories; customers must consult My Oracle Support (MOS) for the specific patch number applicable to their EBS release within the 12.2.3-12.2.15 range. As compensating controls prior to patching, restrict network access to the EBS application tier to trusted internal network segments and block external HTTP access where not operationally required - this limits exposure to insider threats and reduces the population of potential attackers. Audit existing Role Based Security configurations in Product Hub, revoking any overly broad role assignments that grant access beyond operational need. Additionally, review EBS access logs for anomalous Product Hub activity from low-privileged accounts as a detection measure. No vendor-released patch version number is independently verifiable from publicly available data.