What is the CVSS score of CVE-2026-61285?

CVE-2026-61285 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Process Manufacturing Systems are affected by CVE-2026-61285?

Oracle E-Business Suite versions 12.2.11-12.2.15 contain a critical vulnerability in the Process Manufacturing Systems module that enables privileged insiders to achieve complete system compromise,…

How to fix or mitigate CVE-2026-61285?

Within 24 hours, identify all E-Business Suite instances running versions 12.2.11-12.2.15 and audit privileged access logs for the Internal Operations component; immediately implement principle of least privilege by restricting high-privilege accounts. Within 7 days, deploy enhanced monitoring and logging on the Process Manufacturing Systems module's HTTP request handling, implement network segmentation to isolate this component, and reduce high-privilege account exposure through role-based access controls. Within 30 days, evaluate privileged access management (PAM) solutions to control and audit high-privilege operations on affected systems, establish a timeline to upgrade to version 12.2.16 or later when released, and conduct a threat assessment of your manufacturing workflow dependencies to identify critical vs. non-critical systems that can be isolated.

Process Manufacturing Systems CVE-2026-61285

EUVD-2026-47464 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-rm44-qpwj-c63c

Authentication Bypass Oracle Process Manufacturing Systems

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:01 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Process Manufacturing Systems product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.11-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Systems. Successful attacks of this vulnerability can result in takeover of Oracle Process Manufacturing Systems. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of the Oracle Process Manufacturing Systems module in Oracle E-Business Suite 12.2.11 through 12.2.15 is achievable by a high-privileged, authenticated attacker sending crafted HTTP requests to the Internal Operations component. Successful exploitation yields complete takeover of the Process Manufacturing Systems application with high confidentiality, integrity, and availability impact (CVSS 7.2). No public exploit identified at time of analysis and it is not listed in CISA KEV.