What is the CVSS score of CVE-2026-61323?

CVE-2026-61323 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Oracle Advanced Benefits CVE-2026-61323

EUVD-2026-47483 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-7h7v-5f8c-5jj2

Authentication Bypass Oracle Advanced Benefits

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible HTTP exploit requiring only low-privilege credentials; no scope change; pure confidentiality impact with no integrity or availability effect confirmed.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:02 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Internal Operations). The supported version that is affected is 12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Benefits. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Benefits accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data access in Oracle Advanced Benefits 12.2.15 can be achieved by any low-privileged authenticated attacker over HTTP, targeting the Internal Operations component of Oracle E-Business Suite. The flaw - tagged as an Authentication Bypass - permits complete read access to all data accessible within the module, including data classified as critical. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the low attack complexity and absence of required user interaction make it straightforward to exploit once credentials are obtained.

Technical ContextAI

Oracle Advanced Benefits is a human resources and benefits administration module within Oracle E-Business Suite (EBS), a large-scale enterprise application suite. The affected component, Internal Operations, handles backend processing logic within the module. The vendor-assigned tag 'Authentication Bypass' suggests that a legitimately authenticated session can be leveraged to bypass internal authorization controls, enabling access beyond the attacker's intended privilege boundary. No CWE has been assigned by the vendor, but the behavior is consistent with Broken Access Control (CWE-284) or Improper Authorization (CWE-285) patterns common in EBS advisory history. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms a pure confidentiality-impact flaw with no scope change, meaning exploitation is confined to the Oracle Advanced Benefits application boundary.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched build version is not independently confirmed in the available data beyond the CPU reference itself - consult the advisory directly for patch bundle details and prerequisites specific to EBS 12.2.15 environments. While the patch is being applied or if immediate patching is not feasible, restrict network access to the Internal Operations component of Oracle Advanced Benefits to only those hosts and user accounts that require it, using EBS function security profiles and network-layer ACLs to limit HTTP access. Additionally, audit EBS user roles to ensure the principle of least privilege is enforced - removing unnecessary accounts reduces the attacker's entry surface given the PR:L requirement. Monitor EBS application logs for anomalous data access patterns in the Benefits module as a compensating detective control.