What is the CVSS score of CVE-2026-61328?

CVE-2026-61328 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Oracle Cost Management CVE-2026-61328

EUVD-2026-47487 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-9c3j-xw36-q7v5

Oracle Authentication Bypass Cost Management

6.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.6 MEDIUM

Network-accessible HTTP endpoint requires high-privilege credentials and complex conditions to exploit; full C/I/A:H reflects confirmed takeover impact with unchanged scope.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:13 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Cost Management within E-Business Suite versions 12.2.3 through 12.2.15 is achievable by a highly privileged, network-based attacker who can satisfy high attack complexity conditions over HTTP. Successful exploitation yields complete confidentiality, integrity, and availability impact - effectively handing an attacker full control of the Cost Planning component - despite the suppressed base score of 6.6 caused by the PR:H and AC:H barriers. Disclosed by Oracle's secalert team via the July 2026 Critical Patch Update, no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

Oracle E-Business Suite (EBS) is Oracle's integrated enterprise application suite covering financials, supply chain, and manufacturing; Cost Management (Cost Planning component) handles manufacturing cost modeling and supply chain costing workflows within the suite. The vulnerability is exposed over HTTP, placing it in the application's web tier or servlet layer rather than the database or OS level. No CWE identifier was provided by Oracle or NVD, which is consistent with Oracle's typical minimal-disclosure CPU policy - the specific root cause class (e.g., injection, improper access control, deserialization) cannot be confirmed from available data. The CVSS vector AV:N/AC:H/PR:H indicates the flaw is reachable over the network but demands both elevated credentials and specific environmental or configuration conditions to be satisfied simultaneously, a pattern commonly seen in Oracle CPU entries for authenticated server-side vulnerabilities. No CPE strings were included in the provided intelligence.

RemediationAI

Apply the relevant patches from Oracle's Critical Patch Update for July 2026, documented at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publicly disclose exact patched version numbers in CPU materials; administrators must consult My Oracle Support for the specific patch identifiers (patch numbers) applicable to their EBS release within the 12.2.3-12.2.15 range. As a compensating control pending patch application, restrict network access to the EBS Cost Planning component to only trusted internal network segments using perimeter controls or Oracle EBS firewall profiles, reducing exposure for the AV:N attack vector - note this does not eliminate risk if the attacker is already on the internal network. Additionally, audit and minimize the number of accounts holding high-privilege roles in Oracle EBS; reducing the privileged account footprint directly narrows the realistic attacker population given the PR:H requirement. Enforce multi-factor authentication on privileged EBS accounts where supported to reduce credential compromise risk.