What is the CVSS score of EUVD-2026-47244?

EUVD-2026-47244 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle E-Business Suite are affected by EUVD-2026-47244?

Oracle E-Business Suite Customers Online module (versions 12.2.3-12.2.15) contains a privilege escalation vulnerability allowing attackers with low system privileges to read, modify, and delete all…

How to fix or mitigate EUVD-2026-47244?

Within 24 hours: identify all Oracle E-Business Suite installations running Customers Online 12.2.3-12.2.15 and assess their criticality. Within 7 days: apply Oracle Critical Patch Update of July 2026 to all affected systems, prioritizing production environments containing customer or financial data. Within 30 days: complete patching across all environments and verify remediation through version confirmation and security scanning.

Oracle E-Business Suite EUVD-2026-47244

| CVE-2026-61020 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-qm9h-5cvf-c65f

Authentication Bypass Oracle Customers Online

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reachable with only a low-privileged account and no user interaction (AV:N/AC:L/PR:L/UI:N); full data read and modify give C:H/I:H, no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:10 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Customers Online product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Customers Online. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Customers Online accessible data as well as unauthorized access to critical data or complete access to all Oracle Customers Online accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Customers Online (a module of Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read, create, modify, or delete all data accessible to the application. Oracle rates this CVSS 8.1 with high confidentiality and integrity impact but no availability impact, and the intelligence tag 'Authentication Bypass' suggests horizontal privilege escalation past intended access boundaries. No public exploit identified at time of analysis, and the flaw is fixed in the Oracle Critical Patch Update of July 2026.

Technical ContextAI

Oracle Customers Online is a customer-data-management module within Oracle E-Business Suite (EBS), Oracle's flagship on-premises ERP/CRM suite, served over HTTP via the EBS application tier (Oracle Application Server / WebLogic front end). The affected 'Internal Operations' component and the low-privilege prerequisite (PR:L) indicate an authenticated EBS user can reach functionality or data outside their authorization scope. Oracle did not assign a CWE (CWE: N/A), but the 'Authentication Bypass' tag and the C:H/I:H impact pattern point toward a broken access control / improper authorization root cause (CWE-284/CWE-863 class) rather than a memory-safety defect, consistent with a web-application authorization flaw.

RemediationAI

Apply the fix delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); the specific patch is bundled in that CPU for EBS 12.2.x - Patch available per vendor advisory, though a discrete fix version number was not published in the available data, so consult the CPU's EBS advisory and My Oracle Support for the exact patch/RUP level. Because EBS patches often require an application-tier outage and adpatch/AD Online Patching (12.2 uses online patching cycles), schedule a maintenance window and test in a clone first. Until patched, apply compensating controls: restrict network reachability of the EBS application tier so Customers Online is not exposed to the internet (front it with a VPN or reverse-proxy allowlist), tighten user provisioning to minimize low-privileged accounts that can reach the affected functions, and increase monitoring of Customers Online data access and modification logs - noting these controls reduce but do not eliminate exposure from legitimate internal low-privileged users.