EUVD-2026-61755
GHSA-2jv7-c5xp-fph5
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
Network vector confirmed by HTTP delivery; PR:H reflects required high-privilege account; AC:H for non-trivial exploitation; S:C for cross-module scope change; no availability impact described.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite (component: Regression Testing). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Public Sector Human Resources. While the vulnerability is in Oracle Public Sector Human Resources, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Public Sector Human Resources accessible data as well as unauthorized access to critical data or complete access to all Oracle Public Sector Human Resources accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N).
AnalysisAI
Unauthorized data access and modification in Oracle Public Sector Human Resources (E-Business Suite versions 12.2.3-12.2.15) is achievable by a high-privileged remote attacker via HTTP, with exploitation triggering a scope change that can affect systems beyond the directly targeted component. The flaw resides in the Regression Testing component and carries CVSS 3.1 Base Score 7.7, reflecting high confidentiality and integrity impacts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have high-level network access to the Oracle EBS HTTP interface (AV:N) and must possess or compromise a high-privileged EBS account (PR:H), such as an application administrator role with access to the Regression Testing component. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 Base Score of 7.7 is driven primarily by the scope change (S:C) and high confidentiality/integrity impacts (C:H/I:H), which elevate an otherwise constrained attack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the patch included in Oracle's August 2026 Critical Security Patch Update (CSPU), available at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify and inventory all systems running Oracle E-Business Suite versions 12.2.3-12.2.15, document current high-privilege user accounts and their access patterns, enable enhanced HTTP access logging for the HR module, and review recent access logs for unauthorized or anomalous data access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today