What is the CVSS score of CVE-2026-61325?

CVE-2026-61325 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Advanced Benefits are affected by CVE-2026-61325?

Oracle Advanced Benefits 12.2.15 (component of Oracle E-Business Suite) contains a privilege-abuse vulnerability allowing high-privileged attackers to read all application data and make unauthorized…

How to fix or mitigate CVE-2026-61325?

Within 24 hours: Inventory all systems running Oracle Advanced Benefits 12.2.15, document their network accessibility and data classification, and audit current high-privilege account assignments and usage. Within 7 days: Test Oracle July 2026 Critical Patch Update in a staging environment to validate application functionality and performance, coordinate deployment windows with business owners, and establish a phased rollout schedule. Within 30 days: Deploy the July 2026 Critical Patch Update to all affected Oracle Advanced Benefits 12.2.15 instances, prioritizing production systems, and verify successful patching and functionality on each system.

Oracle Advanced Benefits CVE-2026-61325

EUVD-2026-47485 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-h6r5-hpj5-w3rf

Authentication Bypass Oracle Advanced Benefits

7.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

7.6 HIGH

Network HTTP reachable with low complexity and no interaction, but requires a high-privilege EBS account (PR:H); High confidentiality and low integrity impact with a scope change, no availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:54 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 7.6

DescriptionCVE.org

Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Internal Operations). The supported version that is affected is 12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Advanced Benefits. While the vulnerability is in Oracle Advanced Benefits, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Benefits accessible data as well as unauthorized update, insert or delete access to some of Oracle Advanced Benefits accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N).

AnalysisAI

Privilege-abusing data compromise in Oracle Advanced Benefits 12.2.15 (a module of Oracle E-Business Suite, Internal Operations component) lets a high-privileged, network-authenticated attacker read all data accessible to the application and make limited unauthorized modifications. Because the flaw carries a scope change (CVSS S:C), successful attacks may extend impact to other Oracle products beyond Advanced Benefits itself. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; the fix is delivered in the Oracle July 2026 Critical Patch Update.

Technical ContextAI

Oracle Advanced Benefits is a Human Resources / benefits-administration module within the Oracle E-Business Suite (EBS) application stack, exposed over HTTP through EBS's web tier. The vulnerable component is 'Internal Operations,' reached via authenticated application sessions. No CWE was assigned by the source (CWE: N/A), so the precise root-cause class cannot be stated with confidence; however, the vendor tag 'Authentication Bypass' combined with the scope-change flag (S:C) suggests the flaw lets a privileged user cross an authorization or trust boundary and reach data or functionality of adjacent EBS products beyond the security scope of Advanced Benefits. No CPE strings were provided, so affected-product identification relies on the vendor/EUVD version string (Oracle Advanced Benefits 12.2.15).

RemediationAI

Apply the fix delivered in the Oracle July 2026 Critical Patch Update (patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html); no standalone exact fix build number was provided beyond the CPU reference, so consult that advisory for the precise patch/RUP level for EBS 12.2.15 and apply it during your next patch window. Because exploitation requires a high-privilege application account (PR:H), effective compensating controls until patching include tightly restricting and auditing high-privilege Advanced Benefits / EBS 'Internal Operations' accounts, enforcing least-privilege on benefits-administration roles, and enabling database and application audit logging to detect anomalous access or data modification by privileged users. Additionally, limit HTTP exposure of the EBS web tier to trusted internal networks or VPN and monitor for unexpected cross-module data access consistent with the scope-change behavior; the trade-off of restricting privileged roles and network reach is potential disruption to legitimate benefits administrators, so validate role assignments before tightening.