What is the CVSS score of CVE-2026-61289?

CVE-2026-61289 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-61289?

Oracle E-Business Suite 12.2.15's Process Manufacturing Product Development Quality Management Specs component can be fully compromised by any low-privileged authenticated user with network access;…

How to fix or mitigate CVE-2026-61289?

Within 24 hours: audit OPM module access logs, document all low-privilege account holders, and restrict HTTP network access to this component via firewall rules to essential users only. Within 7 days: deploy Web Application Firewall rules targeting Quality Management Specs endpoints to detect anomalous activity, enforce principle of least privilege to minimize low-privilege account permissions, and verify integrity of stored product specifications. Within 30 days: establish continuous monitoring for suspicious OPM module access patterns, evaluate upgrade feasibility to patched E-Business Suite versions, and establish regular communication with Oracle support regarding patch availability timelines.

Oracle E-Business Suite CVE-2026-61289

EUVD-2026-47466 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-x3wx-8p8m-qg2x

Authentication Bypass Oracle Process Manufacturing Product Development

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reach with low complexity and no interaction, gated by a low-privilege EBS account (PR:L); Oracle-described full takeover yields C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:00 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Quality Management Specs). The supported version that is affected is 12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Product Development. Successful attacks of this vulnerability can result in takeover of Oracle Process Manufacturing Product Development. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Takeover of Oracle Process Manufacturing (OPM) Product Development is possible in Oracle E-Business Suite 12.2.15 via its Quality Management Specs component, where a low-privileged attacker with HTTP network access can fully compromise the module. Oracle rates this 8.8 (High) with full confidentiality, integrity, and availability impact, and flags it as easily exploitable, meaning a valid but low-privilege application account is the only barrier. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Process Manufacturing (OPM) Product Development is a module within Oracle E-Business Suite, Oracle's large enterprise resource planning (ERP) application suite typically deployed as a web-accessible middle tier over an Oracle Database backend. The affected 'Quality Management Specs' component handles product/quality specification data used in process (formula-based) manufacturing. No CWE was assigned by Oracle, so the precise root-cause class (e.g., injection, broken access control, or authorization bypass) cannot be stated with certainty; Oracle's own tag of 'Information Disclosure' hints at a data-exposure element, though the CVSS integrity and availability impacts and the 'takeover' language indicate the flaw goes well beyond read-only disclosure. Exact affected component identification here relies on Oracle's advisory text rather than CPE data, as no CPE strings were provided.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory; the input does not specify an exact patched version string) as documented at https://www.oracle.com/security-alerts/cpujul2026.html - Oracle CPU fixes are cumulative and should be applied to the affected 12.2.15 environment through the standard EBS patch process. Until patching is complete, reduce exposure by restricting network access to the EBS application tier so that only trusted internal networks or VPN clients can reach it, and specifically limit access to the OPM Product Development / Quality Management Specs functionality to users who genuinely require it (tightening responsibility/role assignments reduces the pool of low-privilege accounts that could exploit this). Note trade-offs: network restrictions can break legitimate remote or integration access, and removing responsibilities may disrupt quality-management workflows, so validate against business requirements before enforcing. Because this requires an authenticated low-privilege account, also review and disable dormant or unnecessary application accounts and enforce strong authentication to shrink the attack surface.