What is the CVSS score of CVE-2026-61337?

CVE-2026-61337 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Lease and Finance Management are affected by CVE-2026-61337?

A high-severity vulnerability in Oracle Lease and Finance Management (versions 12.2.11-12.2.15) could enable complete compromise of financial operations and data, creating material risk of fraud,…

How to fix or mitigate CVE-2026-61337?

Within 24 hours, identify all Oracle E-Business Suite instances running Lease and Finance Management versions 12.2.11 through 12.2.15 and catalog which systems host production financial records and transactions. Within 7 days, implement network-level access restrictions via firewall rules limiting HTTP access to the module, enable comprehensive audit logging of all module access and modifications, and conduct a user permission review to remove unnecessary privileges. Within 30 days, establish a timeline with Oracle support to obtain and deploy a patched version; deploy Web Application Firewall rules targeting exploitation patterns, maintain continuous security monitoring of the module for suspicious activity, and conduct regular access log reviews to detect indicators of compromise.

Oracle Lease and Finance Management CVE-2026-61337

EUVD-2026-47493 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-g2p8-gc7x-x4vj

Authentication Bypass Oracle Lease And Finance Management

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network HTTP reachable but authenticated (PR:L) and hard to trigger (AC:H); 'takeover' justifies C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:50 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.11-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Lease and Finance Management. Successful attacks of this vulnerability can result in takeover of Oracle Lease and Finance Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full application takeover in Oracle Lease and Finance Management (versions 12.2.11 through 12.2.15), a module of Oracle E-Business Suite's Internal Operations component, lets a low-privileged attacker with HTTP network access compromise the confidentiality, integrity, and availability of the product. Oracle rates the flaw CVSS 3.1 7.5 but marks it 'difficult to exploit' (AC:H) and disclosed it in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis, and it is not listed on the CISA KEV catalog.

Technical ContextAI

Oracle Lease and Finance Management is a leasing and asset-finance application shipped as part of the Oracle E-Business Suite (EBS) 12.2 family, running on the Oracle Application tier (Fusion Middleware/WebLogic plus Apache) and backed by an Oracle Database. The affected 'Internal Operations' component processes authenticated HTTP requests through the EBS web tier, so the flaw is reachable over the network by any account able to log in to the EBS instance. Oracle's advisory assigns no CWE (input CWE = N/A), so the precise root-cause class (e.g., injection, broken access control, or deserialization) cannot be confirmed from the supplied data; the vendor tags it 'Information Disclosure,' yet the CVSS vector reports full C/I/A impact and the description states 'takeover,' indicating impact well beyond simple disclosure.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships EBS security fixes as consolidated CPU patches for the 12.2 line, so no standalone fix version is enumerated in the input - patch available per vendor advisory, with the exact patch/bundle numbers taken from the CPU advisory for your specific 12.2.11-12.2.15 level. Because exploitation needs an authenticated low-privilege session, compensating controls until patching include restricting network reachability of the EBS web tier to trusted internal users/VPN and fronting it with a WAF or reverse proxy, tightening EBS user provisioning so only necessary accounts can reach Lease and Finance Management responsibilities, and reviewing and limiting menu and function access to the affected Internal Operations module (trade-off: may block legitimate leasing operations for constrained users). Enable and monitor EBS and web-tier access logs for anomalous requests to the module. These controls reduce exposure but do not remove the vulnerability; the CPU patch is the only definitive fix.