What is the CVSS score of CVE-2026-61292?

CVE-2026-61292 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle Federal Financials CVE-2026-61292

EUVD-2026-47467 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-q63j-5677-q9rc

Oracle Information Disclosure E Business Suite

4.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Low-privileged network attacker reads a data subset with no integrity or availability impact; vendor-supplied vector is consistent with the described authorization bypass.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:04 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle U.S. Federal Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle U.S. Federal Financials. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle U.S. Federal Financials accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle U.S. Federal Financials (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to read a subset of sensitive financial data via HTTP. Versions 12.2.3 through 12.2.15 are confirmed affected. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS score of 4.3 reflects a moderate-severity information disclosure with no integrity or availability impact.

Technical ContextAI

Oracle U.S. Federal Financials is a module within Oracle E-Business Suite (EBS) 12.2.x designed for U.S. federal government financial management and compliance workflows. The affected component is Internal Operations, which handles internal processing and data routing within the financials module. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U) indicates this is a network-reachable flaw requiring no special configuration or user interaction beyond low-level authentication. The tag 'Authentication Bypass' alongside PR:L suggests the vulnerability may represent an authorization control failure - a low-privileged user bypassing access restrictions to read data beyond their permitted scope - rather than a complete bypass of the authentication layer. No CWE is assigned, leaving the precise root cause class unconfirmed by NVD.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. This CPU addresses CVE-2026-61292 for Oracle U.S. Federal Financials 12.2.3-12.2.15. No exact patched version number beyond 'July 2026 CPU' was provided in the source data. As an interim compensating control, restrict network access to the Oracle EBS Internal Operations component to only authorized internal users and systems - specifically, enforce network perimeter controls (firewall rules or WAF policies) to prevent broad HTTP access to EBS from untrusted network segments. Note that restricting network access does not eliminate the authorization flaw for already-authenticated internal users; the CPU patch remains the definitive fix. Monitor Oracle MOS (My Oracle Support) for patch bundle availability and application instructions specific to the 12.2.x release train.