What is the CVSS score of CVE-2026-61327?

CVE-2026-61327 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-61327?

Oracle E-Business Suite versions 12.2.13-12.2.15 contain an authorization flaw in the Bills of Material Internal Operations component that permits authenticated low-privilege users to read, create,…

How to fix or mitigate CVE-2026-61327?

Within 24 hours, identify all Oracle E-Business Suite instances running versions 12.2.13 through 12.2.15 with Bills of Material module enabled and immediately restrict network access to the vulnerable module to trusted networks only. Within 7 days, implement Web Application Firewall rules to block unauthorized BOM data modifications, activate comprehensive audit logging for all BOM changes, and establish alerts for suspicious data creation, modification, or deletion activity. Within 30 days, contact Oracle support regarding the absence of available patches and security guidance, evaluate upgrade options to Oracle E-Business Suite versions beyond 12.2.15, and develop a detailed remediation timeline for all affected environments.

Oracle E-Business Suite CVE-2026-61327

EUVD-2026-47486 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-qjrr-88gg-wvhm

Authentication Bypass Oracle Bills Of Material

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reachable (AV:N) with low complexity and a low-privileged account (PR:L) yielding full read/write to BOM data (C:H/I:H) but no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:53 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.13-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Bills of Material accessible data as well as unauthorized access to critical data or complete access to all Oracle Bills of Material accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Bills of Material (Internal Operations component) of Oracle E-Business Suite versions 12.2.13 through 12.2.15 allows a low-privileged, network-authenticated attacker to read, create, delete, or modify all data accessible to the Bills of Material module via HTTP. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, the flaw is easily exploitable and requires only low privileges. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor tag references an 'Authentication Bypass' class though the CVSS vector requires PR:L.

Technical ContextAI

Oracle Bills of Material (BOM) is a manufacturing/ERP module within Oracle E-Business Suite (EBS) 12.2, a large Java/PL-SQL enterprise application stack fronted by Oracle Application Server / WebLogic and accessed over HTTP. The affected 'Internal Operations' component handles internal BOM data operations. No CWE was assigned by Oracle, but the 'Authentication Bypass' tag combined with high confidentiality and integrity impact suggests a broken access control or authorization flaw allowing a low-privileged authenticated user to reach data and operations beyond their intended scope. Oracle groups this under its quarterly Critical Patch Update (CPU) process; the affected supported versions are the EBS 12.2.13-12.2.15 release train.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update, which is the primary and only vendor-sanctioned remediation; consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact EBS 12.2.x patch numbers corresponding to your version (no discrete fix version string was provided in the input beyond the CPU reference, so obtain the specific patch from the advisory). Because the CPU is cumulative, ensure the latest 12.2 patch level is installed. As compensating controls until patching, restrict network access to the EBS HTTP endpoints and the Bills of Material/Internal Operations pages to trusted internal networks or VPN only, tighten application-level role and responsibility assignments to minimize which low-privileged users can reach BOM functions, and increase monitoring/auditing of BOM data create/delete/modify operations to detect anomalous access - noting that access restrictions may disrupt legitimate remote or integration users and should be validated against business workflows.