What is the CVSS score of EUVD-2026-47286?

EUVD-2026-47286 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Self-Service HR EUVD-2026-47286

| CVE-2026-61075 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-54fm-4ph7-9pv4

Authentication Bypass Oracle Self Service Human Resources

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-accessible via HTTP with low privilege required; no user interaction; partial confidentiality and integrity impact only; no availability impact consistent with description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:26 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Self-Service Human Resources. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Self-Service Human Resources accessible data as well as unauthorized read access to a subset of Oracle Self-Service Human Resources accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Oracle Self-Service Human Resources within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes an exploitable authorization control weakness in its Internal Operations component, reachable over HTTP without requiring high privileges. A low-privileged authenticated attacker can perform unauthorized read, insert, update, and delete operations against a subset of HR data - impacting both confidentiality and data integrity. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept has been identified at time of analysis; however, the low attack complexity and network-accessible vector make this straightforward to exploit for any authenticated user.

Technical ContextAI

Oracle Self-Service Human Resources is a web-based HR module within Oracle E-Business Suite (EBS), a large-scale enterprise resource planning platform widely deployed in corporate and government environments. The vulnerability resides in the 'Internal Operations' component, accessible via HTTP. The tag 'Authentication Bypass' in conjunction with the CVSS PR:L metric suggests this is more precisely an authorization bypass - a low-privileged user can circumvent access controls to reach data or operations that should be restricted to higher-privilege roles. No CWE identifier was provided, but the pattern is consistent with improper authorization (CWE-285) or insecure direct object reference (CWE-639) class weaknesses. CPE-equivalent scope is Oracle E-Business Suite Self-Service Human Resources 12.2.3 through 12.2.15, as confirmed by EUVD-2026-47286.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU), available via the Oracle security advisory at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number is not independently confirmed from the available references beyond the CPU designation - consult My Oracle Support (MOS) for the precise patch ID and prerequisites specific to your EBS release. If immediate patching is not feasible, restrict network-level access to the Self-Service HR module to only authorized internal HR network segments, reducing exposure from the AV:N attack vector. Additionally, audit and tighten EBS role assignments to ensure that no accounts hold low-privilege access to the Internal Operations component unnecessarily - this limits the pool of potential attackers. Note that network-layer restrictions alone do not eliminate the vulnerability; they only raise the bar for access. A permanent fix requires applying the Oracle CPU patch.