What is the CVSS score of CVE-2026-61315?

CVE-2026-61315 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle EDI Gateway CVE-2026-61315

EUVD-2026-47479 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-mhrf-wc66-vv5r

Oracle Information Disclosure E Business Suite

4.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable HTTP component requiring low-privilege authentication; confidentiality-only partial impact consistent with unauthorized EDI data read within unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:03 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: EDI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle EDI Gateway. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle EDI Gateway accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Oracle EDI Gateway versions 12.2.3 through 12.2.15 exposes an information disclosure vulnerability via HTTP that enables low-privileged authenticated network attackers to read a subset of EDI transaction data without proper authorization. The vulnerability is tagged 'Authentication Bypass' in threat intelligence sources, yet the CVSS vector assigns PR:L, suggesting the bypass operates within an authenticated session - likely circumventing object-level authorization controls rather than bypassing session authentication entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, keeping real-world urgency moderate despite the vendor's characterization of the flaw as 'easily exploitable.'

Technical ContextAI

Oracle EDI Gateway is a component of Oracle E-Business Suite (EBS) that facilitates Electronic Data Interchange - the structured computer-to-computer exchange of business documents such as purchase orders, invoices, and advance shipping notices. The affected version range spans 12.2.3 through 12.2.15, covering the entirety of modern EBS 12.2 deployments up to the most recently released update. The vulnerability resides in the EDI component and is reachable over HTTP (AV:N), indicating it is exposed through the standard EBS web application tier. No CWE classification was provided in available data, limiting formal root-cause categorization; however, the 'Authentication Bypass' tag combined with confidentiality-only impact (C:L/I:N/A:N) and unchanged scope (S:U) is consistent with an authorization bypass pattern - such as insecure direct object reference or missing function-level access control - that allows an authenticated low-privilege user to access EDI records outside their permitted scope without escaping the EDI Gateway component boundary.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses CVE-2026-61315 across the affected Oracle E-Business Suite 12.2.3-12.2.15 range. The exact patched EBS version or patch set ID was not independently confirmed from the available references - consult the CPU advisory directly for the specific patch bundle applicable to your installed release. As a compensating control prior to patching, restrict HTTP access to the Oracle EDI Gateway web component to only those user accounts and network segments with a legitimate business need, using EBS function security profiles or network-layer access controls; this reduces the pool of low-privilege accounts capable of triggering the vulnerability. Note that restricting access to the EDI Gateway endpoint may disrupt legitimate trading partner integrations or batch EDI processing jobs, so any access restriction should be coordinated with application owners before implementation.