What is the CVSS score of CVE-2026-61316?

CVE-2026-61316 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle EDI Gateway CVE-2026-61316

EUVD-2026-47480 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-87qj-rx39-cp63

Information Disclosure Oracle E Business Suite

4.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible HTTP endpoint requiring low-privilege credentials; confidentiality-only partial impact with no integrity or availability effect, unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:02 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: EDI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle EDI Gateway. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle EDI Gateway accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Oracle EDI Gateway versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes an information disclosure vulnerability allowing low-privileged network-authenticated attackers to read a subset of EDI transaction data without proper authorization. Tagged as an authentication bypass, the flaw is exploitable over HTTP with low attack complexity and no user interaction required, suggesting an access-control deficiency that permits privilege escalation within the application layer rather than a full bypass of authentication. No public exploit code and no active exploitation have been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle EDI Gateway is an Oracle E-Business Suite (EBS) component that facilitates Electronic Data Interchange (EDI) - the structured exchange of business documents (purchase orders, invoices, advance ship notices) between enterprise systems over HTTP/HTTPS. The affected release train spans EBS versions 12.2.3 through 12.2.15, representing a broad swath of the 12.2.x long-term support line. No formal CWE is assigned, but the 'Authentication Bypass' tag combined with the CVSS vector (PR:L, meaning some credential is required) suggests an improper authorization flaw - likely a missing or misconfigured access-control check on an EDI Gateway HTTP endpoint - that allows a low-privileged user to reach data scoped to higher-privileged roles. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N confirms network reachability via standard HTTP, minimal attack complexity, and impact confined to partial confidentiality within the EDI Gateway scope only.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, documented at https://www.oracle.com/security-alerts/cpujul2026.html, which contains the fix for this vulnerability. The exact patched build version is not independently confirmed in the available references beyond the CPU advisory scope - consult Oracle's patch delivery mechanism (My Oracle Support) for the specific patch identifier and prerequisite checks applicable to your EBS release. As a compensating control prior to patching, restrict network access to the Oracle EDI Gateway HTTP interface using network-layer controls (firewall rules, load-balancer ACLs) to allow only explicitly authorized hosts or authenticated VPN sessions; note that this reduces exposure but does not remediate the underlying flaw. Additionally, audit E-Business Suite user role assignments to ensure low-privileged accounts do not have broader EDI Gateway access than operationally required, applying the principle of least privilege as a defense-in-depth measure.