What is the CVSS score of CVE-2026-61277?

CVE-2026-61277 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Oracle Marketing CVE-2026-61277

EUVD-2026-47458 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-3r6x-7c69-fjhx

Authentication Bypass Denial Of Service Oracle Marketing

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

PR:L confirmed by description; partial CIA impacts match described read/write/DoS scope; S:U as impact stays within Oracle Marketing only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:06 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Marketing accessible data as well as unauthorized read access to a subset of Oracle Marketing accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Marketing. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Oracle Marketing's Audience component, within Oracle E-Business Suite versions 12.2.3 through 12.2.15, permits low-privileged authenticated network attackers to exploit the application over HTTP with low complexity. Successful exploitation yields unauthorized read access to a subset of marketing data, unauthorized insert/update/delete capability against that data, and the ability to cause a partial denial of service within the Oracle Marketing module. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in the Audience component of Oracle Marketing, a CRM module bundled within Oracle E-Business Suite (EBS) - Oracle's comprehensive enterprise ERP platform covering financials, supply chain, and CRM. The Audience component is used to define and manage customer or contact lists for marketing campaigns. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) is characteristic of a business-logic access control deficiency or insufficient authorization check within the web application layer, allowing a low-privileged user to perform operations or access data beyond their sanctioned scope. No CWE classification was included in the source intelligence, preventing definitive root-cause categorization. Affected versions span the 12.2 release train from 12.2.3 to 12.2.15.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, referenced at https://www.oracle.com/security-alerts/cpujul2026.html and accessible via Oracle My Oracle Support. The exact patched version number is not independently confirmed in available intelligence beyond the July 2026 CPU designation - administrators should consult the advisory directly for applicable patch set identifiers. As a compensating control prior to patching, restrict network-level access to the Oracle EBS application tier to only trusted internal networks and minimize the number of accounts granted low-privileged access to the Oracle Marketing module; note this raises the bar for exploitation but does not eliminate the underlying vulnerability. Disabling the Audience component entirely was not identified as a documented workaround in available data.