What is the CVSS score of CVE-2026-61311?

CVE-2026-61311 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Product Hub are affected by CVE-2026-61311?

Oracle E-Business Suite Product Hub (versions 12.2.3-12.2.15) is vulnerable to privilege escalation (CVE-2026-61311, CVSS 8.8) that allows any authenticated employee or contractor with system access…

How to fix or mitigate CVE-2026-61311?

Within 24 hours, inventory all Oracle E-Business Suite 12.2.3-12.2.15 instances in production and staging environments, and restrict Product Hub access to essential users only via role-based access control and network-level restrictions. Within 7 days, implement enhanced monitoring and audit logging for Product Hub access and activities, enable multi-factor authentication for all E-Business Suite access, and establish baseline security assessments to detect potential indicators of compromise. Within 30 days, maintain vigilant monitoring posture, coordinate with Oracle for patch release timelines, evaluate and execute upgrade paths to supported EBS versions with available security patches, and conduct follow-up assessments to verify remediation effectiveness.

Oracle Product Hub CVE-2026-61311

EUVD-2026-47476 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-x2hm-cc7c-22xm

Authentication Bypass Oracle Product Hub

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reach (AV:N) with low complexity (AC:L) but a required low-privilege EBS account (PR:L), no user interaction, and full component takeover yielding C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:57 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Privilege-based takeover of Oracle Product Hub (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to fully compromise the product via HTTP. Affected releases span EBS 12.2.3 through 12.2.15, and the CVSS 3.1 vector (8.8) reflects high confidentiality, integrity, and availability impact with low attack complexity. No public exploit identified at time of analysis; disclosed through Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Product Hub is the master-data / product information management module within Oracle E-Business Suite (EBS), deployed as part of the EBS 12.2.x application tier and reachable over HTTP. The affected 'Internal Operations' component runs within the EBS web/application stack. No CWE was assigned in the source data, so the precise root-cause class (e.g., injection, access-control flaw, or deserialization) cannot be confirmed; the Oracle tag 'Information Disclosure' hints at a data-exposure element, but the full C:H/I:H/A:H impact indicates the flaw extends well beyond disclosure to complete component takeover. Affected code paths exist consistently across the entire 12.2.3-12.2.15 range, indicating a long-standing issue in the module rather than a recently introduced regression.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (Patch available per vendor advisory; no discrete fixed version string was provided in the input) as documented at https://www.oracle.com/security-alerts/cpujul2026.html - Oracle strongly recommends applying the CPU patches without delay. Because the input contains no exact patched version, consult the CPU advisory for the specific patch numbers matching your 12.2.x level; do not rely on an inferred version. As compensating controls until patching, restrict network reachability of the EBS application tier and the Product Hub / Internal Operations endpoints to trusted internal networks or VPN only (reduces the AV:N exposure but may break legitimate partner/self-service access), tighten EBS account provisioning and review low-privilege responsibilities that can reach Product Hub (addresses the PR:L prerequisite at the cost of administrative overhead), and enable web-tier logging/monitoring on the affected component to detect anomalous requests. These reduce, but do not eliminate, exposure - patching is the only complete fix.