What is the CVSS score of CVE-2026-61299?

CVE-2026-61299 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of E Business Suite are affected by CVE-2026-61299?

Oracle E-Business Suite Process Manufacturing Logistics module (versions 12.2.3-12.2.15) contains an information disclosure and data tampering vulnerability allowing low-privileged users to read all…

How to fix or mitigate CVE-2026-61299?

Within 24 hours, inventory all Oracle EBS instances using versions 12.2.3 through 12.2.15 and restrict HTTP access to the Process Manufacturing Logistics module to trusted network segments using firewall or WAF policies; audit all low-privileged user accounts currently granted access to this module. Within 7 days, implement comprehensive logging and alerting for all read and write operations within Process Manufacturing Logistics, enforce HTTPS-only access to the module, and contact Oracle Support to establish a timeline for patch release or interim security updates. Within 30 days, either upgrade affected EBS instances to version 12.2.16 or later if available, or implement application-level role-based access controls to further restrict low-privileged user visibility and modification rights in the Process Manufacturing Logistics component, and conduct a formal data audit to identify any unauthorized modifications.

E Business Suite CVE-2026-61299

EUVD-2026-47470 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-wr2r-2mp5-cwfw

Authentication Bypass Oracle E Business Suite

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:59 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle Process Manufacturing Logistics product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Logistics. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Process Manufacturing Logistics accessible data as well as unauthorized update, insert or delete access to some of Oracle Process Manufacturing Logistics accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).

AnalysisAI

Information disclosure and limited data tampering in Oracle E-Business Suite's Process Manufacturing Logistics module (Internal Operations component) lets a low-privileged, network-based attacker reach critical application data over HTTP. Affecting supported EBS releases 12.2.3 through 12.2.15, a successful attack yields full read access to all Process Manufacturing Logistics data plus partial write (insert/update/delete) capability. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS was not provided.