EUVD-2026-61734
GHSA-449g-773m-97fh
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Matches vendor-reported vector; network-reachable unauthenticated bypass with high complexity, full confidentiality and integrity impact, and no availability or scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Service Contracts product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Service Contracts. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Service Contracts accessible data as well as unauthorized access to critical data or complete access to all Oracle Service Contracts accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
AnalysisAI
Oracle Service Contracts in E-Business Suite versions 12.2.3 through 12.2.15 exposes an authentication bypass in its Internal Operations component reachable over HTTP without credentials, enabling unauthorized full read and write access to critical service contract data. The CVSS 3.1 score of 7.4 reflects high confidentiality and integrity impact, moderated by high attack complexity (AC:H) that prevents trivial mass exploitation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVSS vector AV:N/AC:H/PR:N/UI:N confirms network-reachable, unauthenticated exploitation over HTTP requiring no user interaction, but with high attack complexity. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.4 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N classifies this as high severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Patch Update for August 2026, which addresses this vulnerability and is documented at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running EBS versions 12.2.3 through 12.2.15 and immediately restrict network access to the Internal Operations component at the firewall level to known administrative networks only; review recent access logs for the affected component to identify any suspicious activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Service Contracts
View allVulnerability in the Oracle Service Contracts product of Oracle E-Business Suite (component: Authoring). Rated high seve
Vulnerability in the Oracle Service Contracts product of Oracle E-Business Suite (component: Authoring). Rated high seve
Oracle Service Contracts (E-Business Suite versions 12.2.3-12.2.15) exposes a network-accessible integrity and confident
Vulnerability in the Oracle Service Contracts component of Oracle E-Business Suite (subcomponent: Renewals). Rated mediu
Unspecified vulnerability in the Oracle Service Contracts component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today