What is the CVSS score of CVE-2026-61333?

CVE-2026-61333 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Product Workbench are affected by CVE-2026-61333?

Oracle Product Workbench within E-Business Suite versions 12.2.3-12.2.15 contains a critical authentication-bypass vulnerability (CVSS 8.1) allowing low-privileged users to read, create, modify, or…

How to fix or mitigate CVE-2026-61333?

Within 24 hours, inventory all Oracle E-Business Suite instances running Product Workbench versions 12.2.3-12.2.15; implement network access controls restricting HTTP connectivity to the application via IP whitelist; enable multi-factor authentication on administrative accounts; and establish monitoring for suspicious data access. Within 7 days, contact Oracle support for remediation timeline, monitor for vendor patches, apply any interim updates when released, validate role-based access control restrictions, and audit data access logs for compromise indicators. Within 30 days, execute an upgrade roadmap to migrate all affected systems to Product Workbench versions beyond 12.2.15 or to patched releases confirmed by Oracle; test upgrades in non-production environments; document completion; and validate post-deployment security posture.

Oracle Product Workbench CVE-2026-61333

EUVD-2026-47489 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-g955-97xm-8www

Authentication Bypass Oracle Product Workbench

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-reachable HTTP function exploitable by any low-privileged authenticated user (PR:L) with no interaction; full data read/write (C:H/I:H) but no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:52 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Workbench. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Product Workbench accessible data as well as unauthorized access to critical data or complete access to all Oracle Product Workbench accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthorized data compromise in Oracle Product Workbench (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged remote attacker with HTTP access read, create, modify, or delete all data accessible to the application. The CVSS 3.1 base score of 8.1 reflects full confidentiality and integrity loss with no availability impact. The flaw is tagged as an authentication-bypass-class issue and was disclosed by Oracle in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.

Technical ContextAI

Oracle Product Workbench is a module within Oracle E-Business Suite (EBS), Oracle's on-premises ERP platform, and the affected code sits in the Internal Operations component of the 12.2.x application tier (12.2.3-12.2.15). EBS exposes these modules through a web/HTTP front end backed by an Oracle database, so the attack surface is a web-facing application function. No CWE was assigned by NVD (CWE: N/A), but the vendor 'Authentication Bypass' tag combined with the C:H/I:H impact profile points to a broken access-control / authorization root cause: an authenticated but low-privileged user reaching data or operations that should be restricted. Because scope is Unchanged (S:U), impact is bounded to data and functions the Product Workbench application itself can reach, not the underlying OS or unrelated EBS modules.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (Patch available per vendor advisory) documented at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle ships EBS security fixes as bundled CPU patches rather than a single tagged release, so identify and apply the specific 12.2.x CPU patch for your installed version from that advisory. No standalone workaround was published in the provided data; as compensating controls until patching, restrict network reachability of the Product Workbench and Internal Operations endpoints to trusted internal networks or VPN only, tighten EBS user provisioning so few accounts hold even low-privilege access, and monitor application/audit logs for anomalous create/modify/delete activity against Product Workbench data - noting that network restrictions may break legitimate remote user access and must be validated against business workflows. Because the primary precondition is a valid low-privilege account, prioritize credential hygiene and prompt deprovisioning alongside the patch.