What is the CVSS score of EUVD-2026-47323?

EUVD-2026-47323 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Oracle Order Management EUVD-2026-47323

| CVE-2026-61112 MEDIUM

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-h6fx-rc7f-688p

Authentication Bypass Information Disclosure Oracle Order Management

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

PR:L confirmed - minimal authentication required; C:H reflects full read access to all Order Management data; I:N and A:N consistent with read-only confidentiality-only impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:22 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Order Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Order Management's Product Diagnostic Tools component (E-Business Suite 12.2.3-12.2.15) allows a low-privileged network attacker to read all data accessible to the application over HTTP with no user interaction required. The 'Authentication Bypass' tag suggests the diagnostic interface fails to enforce proper authorization boundaries, enabling a minimally privileged account to exceed its intended data access scope. No public exploit has been identified at time of analysis, but the low attack complexity and ERP-grade data sensitivity - order records, customer PII, financial data - elevate business impact well beyond the moderate CVSS 6.5 score.

Technical ContextAI

Oracle Order Management is a core module of Oracle E-Business Suite (EBS), an enterprise ERP platform widely deployed in manufacturing, retail, and services sectors. The vulnerable component, Product Diagnostic Tools, is an administrative or support-facing interface used for troubleshooting and diagnostics within the Order Management module. These types of diagnostic endpoints in EBS are typically accessed via HTTP through the standard EBS web tier. The 'Authentication Bypass' tag alongside a CVSS PR:L (low privilege required) vector strongly suggests the component fails to enforce authorization checks after initial authentication - consistent with CWE-863 (Incorrect Authorization) or CWE-284 (Improper Access Control), though Oracle has not assigned a formal CWE. No CPE string was provided, but the affected product is identifiable as Oracle E-Business Suite Order Management versions 12.2.3 through 12.2.15 per the Oracle CPU July 2026 advisory.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html, which contains the fix for this vulnerability across Oracle E-Business Suite 12.2.3-12.2.15. Oracle does not publish discrete patched version numbers in CVE disclosures; consult the CPU release notes directly for applicable patch IDs and My Oracle Support (MOS) documents. As an interim compensating control if patching cannot be applied immediately, restrict HTTP access to the Product Diagnostic Tools endpoint via network ACLs, web application firewall rules, or EBS function security profiles to limit access to only necessary administrators. Additionally, audit and reduce the population of low-privileged accounts with access to the Order Management module. Note that restricting the diagnostic component may impair Oracle Support's ability to assist with troubleshooting, so coordinate with your Oracle support team before disabling it.