What is the CVSS score of CVE-2026-61294?

CVE-2026-61294 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Oracle E-Business Suite Calendar CVE-2026-61294

EUVD-2026-47468 MEDIUM

SQL Injection (CWE-89)

2026-07-21 secalert_us@oracle.com

GHSA-vf52-q35r-885q

Denial Of Service SQLi Oracle Common Applications Calendar

6.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Concurs with vendor vector: HTTP network access, low complexity, low-privilege auth required, no interaction, unchanged scope, partial C/I/A impacts matching description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:04 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

MEDIUM 6.3

DescriptionCVE.org

Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Calendar Synchronizations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Common Applications Calendar. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Common Applications Calendar accessible data as well as unauthorized read access to a subset of Oracle Common Applications Calendar accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Common Applications Calendar. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Unauthorized data manipulation and partial denial of service affects the Calendar Synchronizations component of Oracle Common Applications Calendar in Oracle E-Business Suite versions 12.2.3 through 12.2.15. Low-privileged authenticated attackers with HTTP network access can read a subset of calendar data, insert or modify records, and cause partial service disruption - all without requiring user interaction. Oracle classified this as 'easily exploitable' in its July 2026 Critical Patch Update; no active exploitation has been confirmed and no public exploit code has been identified at time of analysis.

Technical ContextAI

Oracle Common Applications Calendar is a scheduling and collaboration module embedded within Oracle E-Business Suite (EBS), a large-scale enterprise resource planning platform widely used in finance, procurement, and HR workflows. The affected subcomponent, Calendar Synchronizations, handles data-exchange operations between EBS calendar records and external or internal scheduling systems over HTTP. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates the flaw is reachable over the network with no special protocol conditions required beyond a valid low-privilege EBS session. No CWE was assigned by Oracle or NVD, preventing formal root-cause classification; however, the pattern of partial C/I/A impacts with low privilege requirements is consistent with insufficient authorization enforcement on synchronization endpoints - permitting a low-privileged user to act on data outside their intended access scope. Affected versions span 12.2.3 to 12.2.15, a broad range covering many years of EBS deployments.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update, which addresses this vulnerability in Oracle E-Business Suite. The advisory is available at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number was not specified in the available advisory data - patch availability is confirmed per Oracle's CPU publication but a specific fixed release was not independently verifiable from the provided references. Where immediate patching is not feasible, organizations should restrict HTTP network access to the Calendar Synchronizations endpoint to trusted internal network segments, reducing exposure to external or lateral-movement scenarios; note this may disrupt legitimate remote calendar synchronization for distributed users. Additionally, auditing and minimizing the number of active low-privileged EBS accounts with access to calendar features reduces the potential attacker pool. Organizations should treat the next scheduled CPU application cycle as a hard deadline for patching.