What is the CVSS score of CVE-2026-61338?

CVE-2026-61338 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Contracts Integration are affected by CVE-2026-61338?

Oracle Contracts Integration (versions 12.2.3-12.2.15) in E-Business Suite allows any authenticated user to read and modify contract data without authorization, creating exposure across procurement,…

How to fix or mitigate CVE-2026-61338?

Within 24 hours: inventory all Oracle E-Business Suite deployments and confirm which are running versions 12.2.3-12.2.15 with the Contracts Integration module enabled; notify IT and Finance leadership of exposure scope. Within 7 days: restrict Contracts Integration module access via role-based controls to only authorized procurement and contracts personnel; enable database audit logging on all contract tables; isolate or rate-limit HTTP access to the module where operationally feasible. Within 30 days: monitor Oracle security advisories for available patches and test in non-production immediately upon release; evaluate additional network segmentation and access restrictions until patch deployment.

Oracle Contracts Integration CVE-2026-61338

EUVD-2026-47494 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-grq9-p4hr-vj9j

Authentication Bypass Oracle E Business Suite

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP access with low-privilege authentication and low complexity gives PR:L/AC:L; high confidentiality and integrity impact on module data, no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:49 vuln.today

CVE Published

Jul 21, 2026 - 22:19 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contracts Integration. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Contracts Integration accessible data as well as unauthorized access to critical data or complete access to all Oracle Contracts Integration accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Contracts Integration (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read and tamper with all data the module can access over HTTP. Because it is rated easily exploitable with high confidentiality and integrity impact (CVSS 8.1), any authenticated EBS user could pivot to unauthorized creation, deletion, or modification of critical contract data. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is a real but not yet demonstrated concern.

Technical ContextAI

Oracle Contracts Integration is a module of Oracle E-Business Suite (EBS), Oracle's on-premises ERP application suite running on an Oracle Application Server / WebLogic tier backed by an Oracle Database. The affected component, Internal Operations, is reached over HTTP through the EBS web tier. Oracle assigned no CWE, but the reporter tag 'Authentication Bypass' combined with the CVSS profile (low privilege required, high confidentiality and integrity impact, no availability impact) points to a missing or broken authorization/access-control check that lets an already-authenticated low-privilege session act on data beyond its intended scope. The 12.2.x codeline is the long-supported EBS release family, and the affected range spans the full set of 12.2 patch levels (12.2.3 through 12.2.15).

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); the input does not name a discrete fix version, so patch available per vendor advisory - apply the CPU patch matching your exact 12.2.x level. Because exploitation requires an authenticated low-privilege session, compensating controls until patching include tightening EBS user provisioning and reviewing responsibilities/roles that grant access to Contracts Integration and Internal Operations functions, restricting network reachability of the EBS web tier to trusted internal networks or VPN, and enabling and monitoring EBS audit logs for anomalous create/delete/modify activity on contract data. Trade-offs: restricting the web tier may impede legitimate remote users, and role tightening can disrupt staff who rely on those responsibilities, so validate changes in a test instance first. Do not rely on WAF signatures alone, since the malicious traffic is authenticated application HTTP.