What is the CVSS score of CVE-2026-61314?

CVE-2026-61314 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of E Business Suite are affected by CVE-2026-61314?

Oracle EDI Gateway, a critical module in E-Business Suite versions 12.2.3 through 12.2.15, contains a high-severity vulnerability (CVSS 7.2) enabling complete system compromise through authenticated…

How to fix or mitigate CVE-2026-61314?

Within 24 hours, complete an inventory of all Oracle E-Business Suite deployments (versions 12.2.3-12.2.15) to identify systems running EDI Gateway, immediately restrict HTTP network access to affected modules via firewall rules limiting connections to explicitly trusted networks, and enable comprehensive audit logging of all EDI Gateway authentication events and transactions. Over the next 7 days, deploy Web Application Firewall (WAF) rules specific to EDI Gateway endpoints, implement network segmentation to isolate vulnerable systems from general network access, and configure alerting for anomalous EDI authentication and transaction patterns. Within 30 days, establish continuous monitoring of Oracle's quarterly Critical Patch Update announcements for patch availability, develop and test a rapid deployment plan to apply vendor patches within 48 hours of release, and evaluate longer-term mitigation options including EDI Gateway operational suspension if business processes do not require active use of this module.

E Business Suite CVE-2026-61314

EUVD-2026-47478 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-98qc-wvrr-23gg

Authentication Bypass Oracle E Business Suite

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:56 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway. Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle EDI Gateway (a module of Oracle E-Business Suite) is possible where a high-privileged, authenticated attacker with HTTP network access can achieve complete takeover of the component, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 7.2 with high confidentiality, integrity, and availability impact, affecting EBS versions 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.