What is the CVSS score of EUVD-2026-47419?

EUVD-2026-47419 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Item Master EUVD-2026-47419

| CVE-2026-61221 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-fxhg-g2f3-3j6f

Oracle Authentication Bypass E Business Suite

5.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network vector and low complexity confirmed by HTTP access; PR:L required as a valid EBS account is necessary; no availability impact per description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:13 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

MEDIUM 5.4

DescriptionCVE.org

Vulnerability in the Oracle Item Master product of Oracle E-Business Suite (component: iSet-up bugs). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Item Master. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Item Master accessible data as well as unauthorized read access to a subset of Oracle Item Master accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Unauthorized data access and modification in Oracle Item Master (Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by any low-privileged authenticated attacker over HTTP, with no user interaction required. The vulnerability resides in the iSet-up component and enables an attacker to read a subset of Item Master data and perform unauthorized inserts, updates, or deletes beyond their intended authorization scope. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog; however, the 'Authentication Bypass' tag suggests an authorization boundary failure that could be straightforward to exploit once an attacker holds any valid account.

Technical ContextAI

Oracle Item Master is a module within Oracle E-Business Suite (EBS), Oracle's flagship on-premises enterprise resource planning platform, used to manage product/item definitions across supply chain, manufacturing, and procurement workflows. The vulnerable component is labeled 'iSet-up bugs,' indicating the iSetup utility - a data migration and configuration tool within EBS that facilitates import and export of setup data across instances. The CWE is listed as N/A by the reporter, but the 'Authentication Bypass' tag in the ENISA EUVD entry (EUVD-2026-47419) and the CVSS PR:L rating together indicate an authorization control failure rather than a complete bypass of authentication: a legitimately authenticated low-privilege user can exceed their intended access scope, a pattern consistent with improper authorization (CWE-285) or broken access control (CWE-284) in EBS role-based access control enforcement within iSetup. The attack surface is entirely HTTP-based, meaning no special network adjacency or local access is required.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPUs are cumulative, so applying the July 2026 CPU will address this and all prior unpatched issues. No exact patched release version (e.g., a specific EBS patch number) was independently confirmed from the available intelligence data - obtain the specific patch ID from Oracle My Oracle Support (MOS) using the CPU advisory. As a compensating control prior to patching, restrict access to the iSetup component by reviewing and tightening EBS function security and menu exclusions for all low-privileged roles, thereby limiting which users can invoke iSetup-related functions. Additionally, audit EBS access logs for anomalous item master read or write activity by accounts that should not have Item Master access. Note that restricting iSetup access may affect legitimate data migration workflows and should be coordinated with EBS administrators.