What is the CVSS score of CVE-2026-61297?

CVE-2026-61297 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Customers Online are affected by CVE-2026-61297?

Oracle E-Business Suite's Customers Online component contains an authentication-bypass-class vulnerability (CVE-2026-61297) that permits authenticated users with low-level privileges to read, create,…

How to fix or mitigate CVE-2026-61297?

Within 24 hours, identify all systems running Oracle E-Business Suite Customers Online component and document data classification levels and business function dependencies. Within 7 days, restrict HTTP network access to the Customers Online component to essential administrative networks using firewall rules, deploy Web Application Firewall (WAF) rules to detect and block anomalous create/read/delete/modify operations, and enable comprehensive audit logging with real-time alerts on all data access and modification events. Within 30 days, establish monitoring dashboards for unusual access patterns to the component, conduct forensic review of access logs for the past 90 days to identify any unauthorized access, and monitor Oracle Security Alerts regularly to apply the vendor patch immediately upon release.

Oracle Customers Online CVE-2026-61297

EUVD-2026-47469 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-m9cf-7x5x-r4w8

Authentication Bypass Oracle Customers Online

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reach with low complexity and no UI, but a valid low-privilege account is required (PR:L); broad read/write of customer data gives C:H/I:H, no availability impact so A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:59 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Customers Online product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Customers Online. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Customers Online accessible data as well as unauthorized access to critical data or complete access to all Oracle Customers Online accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Broad data compromise in Oracle Customers Online (part of Oracle E-Business Suite, component: Internal Operations) allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High), it carries full confidentiality and integrity impact with no availability impact, and Oracle tags it as an authentication-bypass-class weakness. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and modest privilege requirement make it a high-priority fix.

Technical ContextAI

Oracle Customers Online is a Customer Data Management module within Oracle E-Business Suite (EBS), Oracle's enterprise ERP/CRM platform, delivered through the EBS web tier (Oracle Application Server/WebLogic front end) over HTTP. The affected 'Internal Operations' component handles customer master-data operations, so a flaw here exposes core customer records. Oracle's own tag of 'Authentication Bypass' suggests the root cause is a missing or improper access-control/authorization check that lets an already-authenticated low-privilege user reach data or functions beyond their intended scope. No CWE was assigned in the input (CWE: N/A), so the precise weakness class is inferred from the vendor tag and the C:H/I:H impact rather than a formal classification.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to all Oracle E-Business Suite 12.2 environments in the 12.2.3-12.2.15 range - Patch available per vendor advisory; Oracle CPUs are cumulative, so the July 2026 EBS patch bundle is the primary remediation and no standalone fix version was published in the input beyond that advisory. Because exploitation requires a low-privilege authenticated account, compensating controls until patching completes include restricting network access to the EBS web tier to trusted internal networks/VPN (reduces exposure but may disrupt remote/partner access), tightening account provisioning and disabling any self-service or default low-privilege accounts on Customers Online (reduces the pool of usable credentials at the cost of onboarding friction), and increasing monitoring/alerting on unusual customer-data read/write/delete activity in the Internal Operations component (detective only, does not prevent the action). Do not treat network filtering alone as sufficient, since a legitimate low-privilege user can still exploit it.