What is the CVSS score of CVE-2026-61303?

CVE-2026-61303 has a CVSS 3.1 base score of 1.9 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Oracle EDI Gateway CVE-2026-61303

EUVD-2026-47472 LOW

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-cxg5-g82r-96j7

Oracle Information Disclosure E Business Suite

1.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

1.9 LOW

AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

1.9 LOW

Local attack vector and high complexity reflect infrastructure logon requirement; PR:H reflects high-privileged attacker prerequisite; only low confidentiality impact confirmed, no integrity or availability.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:03 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle EDI Gateway executes to compromise Oracle EDI Gateway. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle EDI Gateway accessible data. CVSS 3.1 Base Score 1.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Limited unauthorized data read in Oracle EDI Gateway (E-Business Suite versions 12.2.3-12.2.15) requires a high-privileged attacker with local logon access to the underlying infrastructure, combined with difficult exploitation conditions, to access a subset of EDI data without authorization. The confidentiality impact is narrow and no integrity or availability impact is present. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via the July 2026 Critical Patch Update.

Technical ContextAI

Oracle EDI Gateway is an Electronic Data Interchange integration component within Oracle E-Business Suite, responsible for translating and routing business documents between internal Oracle applications and external trading partners. The vulnerability resides in the 'Internal Operations' component of EDI Gateway, affecting versions 12.2.3 through 12.2.15 as identified in the NVD CPE data and EUVD advisory (EUVD-2026-47472). No CWE identifier was assigned, limiting root-cause classification. The 'Authentication Bypass' tag supplied in intelligence metadata is in tension with the CVSS PR:H metric - if high privileges are required, a true authentication bypass would be atypical; this may instead reflect an authorization boundary bypass (a high-privileged user accessing data outside their intended scope within the EDI subsystem) rather than an unauthenticated bypass. Clarification from Oracle's advisory would be needed to confirm the precise mechanism.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update, which addresses this vulnerability according to the advisory at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched release version of Oracle EDI Gateway is not independently confirmed from the available data - verify the specific patch number within Oracle's CPU documentation. As a compensating control pending patching, restrict local logon access to the infrastructure hosting Oracle EDI Gateway to the minimum set of necessary high-privileged accounts, as AV:L and PR:H mean that eliminating unauthorized local access effectively blocks exploitation. Audit which accounts currently hold the privilege level required (PR:H) on the EDI Gateway host. No workarounds beyond access restriction are identified in available references.