What is the CVSS score of EUVD-2026-47253?

EUVD-2026-47253 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle E-Business Suite are affected by EUVD-2026-47253?

Oracle Financials for the Americas module in E-Business Suite versions 12.2.3-12.2.15 can be completely compromised via HTTP by attackers with existing high application privileges, enabling…

How to fix or mitigate EUVD-2026-47253?

Within 24 hours, identify all E-Business Suite instances running Financials for the Americas module in versions 12.2.3-12.2.15 and restrict HTTP access to these systems to authorized administrative networks only; simultaneously audit and document all users with high application privileges. Within 7 days, enforce multi-factor authentication on all high-privilege accounts accessing affected instances, implement network segmentation isolating these modules, and establish daily access log reviews for suspicious activity. Within 30 days, monitor Oracle's security bulletins for patch availability and plan migration to version 12.2.16 or later; simultaneously reduce high-privilege role assignments to the minimum necessary personnel and deploy continuous anomaly detection on access patterns to affected modules.

Oracle E-Business Suite EUVD-2026-47253

| CVE-2026-61035 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-x9ch-3qv9-m2r6

Authentication Bypass Oracle E Business Suite

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network HTTP reachable and low-complexity, but requires an existing high-privilege EBS account (PR:H); unchanged scope with full confidentiality, integrity, and availability loss from module takeover.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:06 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Financials for the Americas product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Financials for the Americas. Successful attacks of this vulnerability can result in takeover of Oracle Financials for the Americas. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of the Oracle Financials for the Americas module within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) is possible via HTTP by an attacker who already holds high application privileges, leading to complete takeover of the module's confidentiality, integrity, and availability. Oracle rates it CVSS 7.2 and describes it as 'easily exploitable' once the privilege prerequisite is met. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the sole reference is the Oracle July 2026 Critical Patch Update advisory.

Technical ContextAI

Oracle Financials for the Americas is a regional financial-management component of the Oracle E-Business Suite (EBS) ERP platform, and the flaw resides in its 'Internal Operations' subcomponent. EBS is a large Java/PL-SQL web application stack fronted by Oracle HTTP Server, so the 'network access via HTTP' vector points at the web tier of an authenticated EBS deployment rather than a database-only interface. No CWE was assigned in the source data, so the precise root-cause class (e.g., injection, access-control, or deserialization weakness) cannot be stated with confidence; Oracle's tagging of 'Information Disclosure' plus the C:H/I:H/A:H impact and 'takeover' language indicate the defect lets an already-privileged user break the module's intended authorization boundaries and gain full control of its data and operations.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); this is the authoritative source and Oracle strongly recommends applying the full CPU rather than individual fixes, though a specific patched EBS 12.2.x release number is not enumerated in the available data (Patch available per vendor advisory - exact fix version not stated in source). Until the CPU is applied, reduce exposure by tightening who holds high-privilege EBS roles for the Financials for the Americas / Internal Operations functions, reviewing and pruning privileged responsibility grants, and restricting network reachability of the EBS web tier to trusted administrative networks or VPN so the HTTP attack surface is not broadly accessible; increase auditing and monitoring of privileged user activity in the affected module. These access-restriction controls can impede legitimate remote finance operations and should be validated against business workflows before enforcement.