What is the CVSS score of CVE-2026-61320?

CVE-2026-61320 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Payables are affected by CVE-2026-61320?

Oracle Payables (Oracle E-Business Suite) can be fully compromised by any low-privilege authenticated user (CVSS 8.8, CVE-2026-61320); no public exploit identified at time of analysis.

How to fix or mitigate CVE-2026-61320?

Within 24 hours: audit all low-privilege accounts accessing Oracle E-Business Suite Payables module, restrict module access to authorized financial personnel only, and enable enhanced transaction-level audit logging. Within 7 days: implement network segmentation for Payables systems, deploy real-time monitoring for privilege escalation attempts, and contact Oracle Support for patch availability and remediation timeline. Within 30 days: immediately apply vendor patch upon release, perform forensic review of Payables transaction logs for suspicious activity since vulnerability disclosure, and re-baseline access controls across all EBS modules.

Oracle Payables CVE-2026-61320

EUVD-2026-47481 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-39vq-869j-8vw6

Oracle Privilege Escalation E Business Suite

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reachable with low complexity and only a low-privilege EBS account (PR:L), no user interaction, yielding full application takeover so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:55 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Payables product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.8-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payables. Successful attacks of this vulnerability can result in takeover of Oracle Payables. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Payables (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to take over the module via HTTP, with high impact to confidentiality, integrity, and availability (CVSS 3.1 8.8). Any user holding a valid low-privilege EBS session can escalate to full control of the Payables application. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' vendor language make it a strong patching priority.

Technical ContextAI

Oracle Payables is the accounts-payable module of Oracle E-Business Suite (EBS), Oracle's on-premises/enterprise ERP platform, and the flaw sits in its Internal Operations component, typically reached over the HTTP tier of the EBS application server. Oracle does not disclose the underlying weakness class (CWE is N/A) and provides no root-cause detail; the CVSS vector (S:U, C/I/A all High) combined with the 'takeover' language points to a flaw that grants an authenticated user access to functionality or data beyond their entitlement within the same application context rather than a scope-crossing host compromise. Because EBS exposes Payables through shared web/servlet infrastructure, the network HTTP attack surface is consistent with authenticated request manipulation against a Payables endpoint.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Patch available per vendor advisory, though Oracle's CPU does not publish a single discrete fix-version string in the provided data, so identify the exact EBS 12.2.x patch/patchset for your release from the CPU patch matrix. Because all affected releases are in the 12.2.8-12.2.15 band, prioritize this in your next EBS patching cycle. As compensating controls until patched, restrict network reachability of the EBS application tier so Payables endpoints are not exposed to untrusted networks or the internet, tighten who holds Payables/EBS accounts and review low-privilege role assignments (since PR:L is the exploitation gate), and increase monitoring of Payables transactions and admin actions for anomalies; note the trade-off that network restrictions may disrupt legitimate remote or integration access and should be validated against business workflows.