What is the CVSS score of CVE-2026-61309?

CVE-2026-61309 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-61309?

A critical data disclosure vulnerability in Oracle E-Business Suite (versions 12.2.3-12.2.15) allows unauthenticated attackers to access sensitive business data-financial records, operational…

How to fix or mitigate CVE-2026-61309?

Within 24 hours: Identify all Oracle EBS instances running versions 12.2.3-12.2.15; immediately implement network segmentation to restrict HTTP access to the In-Memory Cost Management component from external networks and confine access to internal management subnets only. Within 7 days: Enable detailed HTTP access logging and alerting for this component, configure Web Application Firewall rules to block suspicious queries, and contact Oracle support for patch timeline and workarounds. Within 30 days: Establish a project timeline with Oracle and your database administration team to upgrade affected EBS versions; prioritize instances handling financial data, customer information, or operational secrets.

Oracle E-Business Suite CVE-2026-61309

EUVD-2026-47474 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-hjw5-x9v4-83pr

Authentication Bypass Oracle In Memory Cost Management For Discrete Industries

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated remote HTTP access with low complexity (AV:N/AC:L/PR:N/UI:N) yields high confidentiality disclosure only, with no integrity or availability impact per Oracle.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:58 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle In-Memory Cost Management for Discrete Industries product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle In-Memory Cost Management for Discrete Industries. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle In-Memory Cost Management for Discrete Industries accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in the Oracle In-Memory Cost Management for Discrete Industries component (Internal Operations) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows an unauthenticated, network-based attacker over HTTP to read critical or all data accessible to the product. The flaw is rated CVSS 3.1 7.5 with a pure confidentiality impact (C:H/I:N/A:N) and was disclosed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, though the 'Authentication Bypass' tag and low attack complexity make it an attractive target for internet-exposed EBS instances.

Technical ContextAI

Oracle E-Business Suite (EBS) is a large integrated ERP suite; the affected component, In-Memory Cost Management for Discrete Industries under the Internal Operations module, handles manufacturing cost calculations and stores sensitive business/financial data. Because exploitation occurs over HTTP without authentication, the weakness most plausibly resides in an EBS servlet, OA Framework page, or web endpoint that fails to enforce access control, consistent with the supplied 'Authentication Bypass' tag. No CWE was assigned in the input, but the behavior aligns with the missing-authentication/broken-access-control class (e.g., CWE-306 Missing Authentication for Critical Function or CWE-862 Missing Authorization). EBS 12.2.x runs on the Oracle WebLogic/Fusion Middleware and Oracle Database stack, and cost-management data typically includes proprietary product costing and financial figures.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (patch available per vendor advisory; no standalone fix version string was provided in the input) by following the CPU documentation at https://www.oracle.com/security-alerts/cpujul2026.html and installing the corresponding EBS 12.2 patch for your version. Because Oracle bundles EBS fixes into the quarterly CPU and does not publish per-CVE point versions here, confirm the exact patch number for your 12.2.3-12.2.15 release in the CPU advisory. As compensating controls until patching, restrict network reachability of the affected In-Memory Cost Management / Internal Operations endpoints - place EBS behind a VPN or reverse proxy and block external HTTP access to the vulnerable servlet paths, and use Oracle's URL Firewall / allow-list (mod_security or the EBS DMZ 'url_fw' configuration) to permit only required responsibilities and pages; the trade-off is that overly broad URL blocking can break legitimate self-service or integration traffic, so validate allow-lists against active business flows before enforcing.