What is the CVSS score of CVE-2026-61279?

CVE-2026-61279 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Oracle Proposals CVE-2026-61279

EUVD-2026-47460 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-p788-3gfp-394h

Oracle Denial Of Service Information Disclosure E Business Suite

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Network-accessible HTTP flaw requiring low-privilege EBS account; partial C/I/A impacts confined to Proposals component with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:05 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Proposals product of Oracle E-Business Suite (component: Proposals). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Proposals. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Proposals accessible data as well as unauthorized read access to a subset of Oracle Proposals accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Proposals. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Oracle Proposals (component of Oracle E-Business Suite versions 12.2.3 through 12.2.15) is exploitable by low-privileged authenticated remote attackers over HTTP, enabling unauthorized read access to a subset of data, unauthorized data manipulation (insert, update, delete), and partial denial of service against the Proposals component. Oracle disclosed this vulnerability in its July 2026 Critical Patch Update (CPU). No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

Oracle Proposals is a component within Oracle E-Business Suite (EBS), Oracle's flagship enterprise resource planning platform used for procurement, financials, and project management. The affected versions span 12.2.3 through 12.2.15, indicating a broad release window of the 12.2.x Release 12 branch. The vulnerability is exposed via HTTP, meaning it resides in the web-tier of EBS (typically served through Oracle HTTP Server and Oracle Application Framework). No specific CWE is assigned by Oracle, which is consistent with Oracle's typical CPU disclosures that withhold root-cause details. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U) indicates the flaw is straightforwardly reachable over the network with no complexity barrier, requiring only a valid low-privileged account - consistent with authenticated EBS application users exploiting a broken access control, insufficient input validation, or privilege escalation flaw within the Proposals module.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability for Oracle E-Business Suite Release 12.2. Oracle CPUs are cumulative, so organizations should apply the full July 2026 CPU rather than a selective patch. The exact patched version within the 12.2.x branch is not independently confirmed beyond the CPU advisory. If immediate patching is not feasible, compensating controls should include restricting access to the Oracle Proposals module to only users with a verified business need, enforcing network-layer controls to limit HTTP access to the EBS application tier from untrusted network segments, and increasing audit logging on the Proposals component to detect unauthorized data access or modification. Note that network-layer restriction may impact legitimate remote EBS users and should be coordinated with application teams.