What is the CVSS score of CVE-2026-61283?

CVE-2026-61283 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Oracle Bills of Material CVE-2026-61283

EUVD-2026-47463 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-xw2v-h74q-g68h

Authentication Bypass Denial Of Service Oracle Bills Of Material

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Network-reachable Web Services endpoint requires only low-privileged credentials; partial impacts across C/I/A with unchanged scope match Oracle's description precisely.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:04 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Web Services). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Bills of Material accessible data as well as unauthorized read access to a subset of Oracle Bills of Material accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Bills of Material. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Oracle Bills of Material's Web Services component in E-Business Suite 12.2.3-12.2.15 exposes a medium-severity flaw allowing low-privileged authenticated attackers to compromise data confidentiality, integrity, and availability via HTTP. Exploitation yields unauthorized read access to a subset of Bills of Material data, unauthorized insert, update, or delete capability, and the ability to cause a partial denial of service against the module. No public exploit code or CISA KEV listing has been identified at time of analysis; this was disclosed as part of Oracle's Critical Patch Update for July 2026.

Technical ContextAI

Oracle Bills of Material is a module within the Oracle E-Business Suite (EBS) ERP platform, primarily used in discrete and process manufacturing for managing product structures and routings. The affected component is the Web Services interface exposed by this module, which enables programmatic access to Bills of Material functionality over HTTP. The exact root cause class is not disclosed by Oracle - no CWE has been assigned - which is consistent with Oracle's standard CPU disclosure practice of withholding root-cause details. The attack vector (AV:N, AC:L) confirms the Web Services endpoint is reachable over the network without requiring a complex precondition. Affected CPE corresponds to Oracle E-Business Suite releases 12.2.3 through 12.2.15.

RemediationAI

Apply the patches released by Oracle as part of the Critical Patch Update (CPU) for July 2026, available via My Oracle Support and detailed at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not disclose a specific patched version number in CPU advisories; customers should reference the CPU patch availability matrix for their exact E-Business Suite release. As a compensating control where immediate patching is not feasible, restrict network access to the Bills of Material Web Services endpoint via firewall rules or EBS application-layer controls to permit only trusted internal hosts or service accounts - this directly addresses the AV:N attack vector. Additionally, audit and minimize the number of low-privileged accounts with access to the Bills of Material module to reduce the exploitable attack surface. Note that restricting the Web Services endpoint may impact integrations or third-party applications that rely on programmatic access to Bills of Material data.