EUVD-2026-61767
GHSA-8jvc-c3q6-c4h4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Network HTTP access with low privilege required; high confidentiality loss from data exposure, limited integrity write access, no availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Financials for EMEA product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financials for EMEA. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Financials for EMEA accessible data as well as unauthorized update, insert or delete access to some of Oracle Financials for EMEA accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
AnalysisAI
Oracle Financials for EMEA (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to gain unauthorized read access to critical financial data and perform limited unauthorized write operations via HTTP. The vulnerability resides in the Internal Operations component and, despite requiring an existing account, carries a High confidentiality impact given the sensitivity of EMEA financial records involved. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a valid, low-privileged account with network access to the Oracle EBS HTTP interface - a session-authenticated context is necessary per the CVSS PR:L metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.1 is reasonably calibrated: the network vector, low complexity, and no user-interaction requirement raise the base score, while the Low privilege requirement and absence of availability impact temper it. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the patches released in Oracle's Critical Patch Update (CPU) for August 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all E-Business Suite instances running versions 12.2.3 through 12.2.15 across your EMEA infrastructure and flag systems that contain sensitive financial data. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Financials For Emea
View allSame weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today