What is the CVSS score of CVE-2026-61301?

CVE-2026-61301 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-61301?

Oracle Process Manufacturing Financials in E-Business Suite versions 12.2.3-12.2.15 is vulnerable to unauthorized access and modification of financial data by low-privileged internal users.

How to fix or mitigate CVE-2026-61301?

Within 24 hours, inventory all systems running Oracle EBS versions 12.2.3-12.2.15 with the Internal Operations component enabled. Within 7 days, implement network segmentation to restrict access to the Process Manufacturing Financials module to essential personnel, enable detailed audit logging for all create/modify/delete operations on financial records, and review all low-privileged user accounts with access to this component. Within 30 days, establish a formal upgrade plan with Oracle Support to migrate to version 12.2.16 or later, and conduct a forensic audit of financial data changes for the past 90 days to detect unauthorized modifications.

Oracle E-Business Suite CVE-2026-61301

EUVD-2026-47471 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-vmqg-8cgp-c8xr

Authentication Bypass Oracle Process Manufacturing Financials

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reachable (AV:N/AC:L) but a low-privilege EBS account is required (PR:L); high confidentiality and integrity impact with no availability effect, matching Oracle's own vector.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:58 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Process Manufacturing Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Financials. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Process Manufacturing Financials accessible data as well as unauthorized access to critical data or complete access to all Oracle Process Manufacturing Financials accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Process Manufacturing Financials (Internal Operations component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged, network-adjacent attacker to read, create, modify, or delete all data accessible to the module over HTTP. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impact but no availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle EBS is a recurring target for post-authentication attacks.

Technical ContextAI

Oracle E-Business Suite (EBS) is a large, web-based enterprise ERP/financials platform; the affected Process Manufacturing (OPM) Financials module handles cost accounting and financial data for process-manufacturing operations, exposed through EBS's HTTP application tier. The CWE is not assigned (N/A) in the source data, but the CVSS profile (network HTTP access, low privilege required, high confidentiality and integrity impact, no availability impact) is consistent with a broken access-control or authorization flaw that lets an authenticated user reach data or operations beyond their intended scope. The 'Authentication Bypass' tag conflicts with the CVSS PR:L metric, which indicates some authentication is required; this discrepancy should be verified against the Oracle advisory rather than treated as confirmed unauthenticated access.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory; no discrete fix version string is provided beyond the CPU) - see https://www.oracle.com/security-alerts/cpujul2026.html and apply the OPM Financials / EBS 12.2 patches referenced there for your exact 12.2.x level. Because exploitation requires an authenticated low-privilege account, compensating controls until patching completes include restricting and reviewing access to the Process Manufacturing Financials responsibilities and menus, tightening EBS role/responsibility assignments to enforce least privilege, and limiting network reachability of the EBS application tier to trusted internal networks or VPN rather than exposing it directly to the internet; the trade-off is reduced accessibility for legitimate remote or partner users. Enable and monitor EBS audit logging on OPM Financials data access to detect anomalous read/modify/delete activity as a detective control.