EUVD-2026-61713
GHSA-hjf5-rj4m-vxj7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-delivered over HTTP with low privilege required; high C and I confirmed by description; no availability impact stated.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Risk Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Risk Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Risk Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Risk Management accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
AnalysisAI
Oracle Risk Management versions 12.2.3 through 12.2.15 in Oracle E-Business Suite exposes critical data to low-privileged authenticated attackers over HTTP via a flaw in the Internal Operations component, tagged as an authentication bypass. A successful attack grants full unauthorized read access to all Risk Management data and the ability to create, delete, or modify critical records. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, low-privileged authenticated account within Oracle E-Business Suite - the CVSS vector PR:L confirms authentication is required but at the lowest privilege tier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.1 (High) is supported by concrete vector metrics: network-reachable, low complexity, low privilege, no user interaction, with high confidentiality and integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Oracle's Critical Patch Update (CPU) for August 2026, available via https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all EBS deployments running Risk Management versions 12.2.3-12.2.15 and implement network-level access controls restricting low-privileged users from reaching the Internal Operations component; enable HTTP access logging for Risk Management traffic. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Risk Management
View allFull takeover of Oracle Risk Management (E-Business Suite versions 12.2.3-12.2.15) is achievable by any low-privileged a
Data compromise in Oracle Risk Management (part of Oracle E-Business Suite 12.2.3 through 12.2.15, Internal Operations c
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today