What is the CVSS score of EUVD-2026-47247?

EUVD-2026-47247 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle iRecruitment are affected by EUVD-2026-47247?

Oracle iRecruitment module in E-Business Suite versions 12.2.3-12.2.15 is vulnerable to authenticated remote takeover, allowing high-privilege attackers to achieve complete system compromise…

How to fix or mitigate EUVD-2026-47247?

Within 24 hours, identify and document all Oracle E-Business Suite instances running iRecruitment in versions 12.2.3 through 12.2.15, including their criticality and current configuration. Within 7 days, obtain and stage the July 2026 Critical Patch Update for Oracle E-Business Suite, complete testing in lower environments, and establish a deployment timeline for production systems. Within 30 days, apply the July 2026 Critical Patch Update to all affected production systems, validate successful patching with vulnerability scanning, and confirm iRecruitment module functionality post-patch.

Oracle iRecruitment EUVD-2026-47247

| CVE-2026-61025 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-39gw-x3gg-p9xp

Authentication Bypass Oracle Irecruitment

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network HTTP reachable (AV:N) and low-complexity (AC:L) but requires an existing high-privileged iRecruitment account (PR:H); full module takeover yields C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:09 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iRecruitment. Successful attacks of this vulnerability can result in takeover of Oracle iRecruitment. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle iRecruitment (Oracle E-Business Suite, Internal Operations component) is possible in versions 12.2.3 through 12.2.15, where a high-privileged attacker with network HTTP access can achieve complete takeover of the module with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and addressed it in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a patch-priority issue driven by the total-takeover impact rather than by confirmed in-the-wild activity.

Technical ContextAI

Oracle iRecruitment is the recruiting/applicant-tracking module of Oracle E-Business Suite (EBS), a large Java/PL-SQL enterprise resource planning platform typically fronted by Oracle Application Server / HTTP Server and backed by an Oracle Database. The affected 'Internal Operations' component handles internal application processing within iRecruitment. Oracle's advisory does not assign a CWE (CWE: N/A) and provides no technical root-cause detail, which is normal for Oracle CPU entries; the CVSS vector (S:U, full CIA impact, PR:H) indicates a flaw exploitable by an already-authenticated privileged EBS user over HTTP that yields control of the iRecruitment application itself without crossing a security scope boundary. Without a CWE or code-level detail, the specific weakness class (e.g., injection, access-control, or deserialization) cannot be confirmed from the available data.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle publishes iRecruitment/EBS patches by version through this CPU, so identify and apply the specific patch for your deployed 12.2.x level (12.2.3-12.2.15) via My Oracle Support. Patch available per vendor advisory - no standalone fixed build number was provided in this input, so confirm the exact patch ID for your release against the CPU matrix. As compensating controls until patched, because exploitation requires a high-privileged authenticated user, tighten iRecruitment/EBS privileged account governance: audit and minimize accounts holding elevated iRecruitment responsibilities, enforce strong authentication and session controls, and restrict HTTP access to the iRecruitment application (network segmentation / reverse-proxy allow-listing) so only trusted internal users reach it - accepting that this may impede legitimate remote recruiters. Increase logging and monitoring of privileged iRecruitment actions to detect abuse in the interim.